Instagram Sabotage: The Saga Continues

Following another wave of attacks on the Instagram accounts of activists, independent media and civil society organisations, SHARE Foundation called on Meta to investigate potential networks engaged in coordinated inauthentic behaviour and to take appropriate measures to dismantle them, including shutting down the accounts of those organising such activity. We also requested the establishment of communication channels with organisations in Serbia and the wider region working on human rights protection – particularly freedom of information – as well as additional platform safeguards for official media and civil society accounts.

This new form of digital censorship in Serbia emerged late last year through targeted mass follower inflation, which is likely being used to automatically trigger account suspensions on social media for “inauthentic behaviour” (although the precise mechanics of this tactic have not yet been conclusively documented).

SHARE Foundation collected testimonies from twenty users who were exposed to this type of attack and whose Instagram accounts were temporarily or permanently suspended. We examined what information they received regarding the suspension, what responses they obtained to their appeals, how long the process lasted, and whether they were able to reach non-automated support.

Anatomy of a digital sabotage

We also observed that attacks were typically launched on Friday evenings local time in Serbia, likely to delay responses from targeted accounts and the platform.

In most cases, account holders were subject to standard suspension notices without specific explanations, while automated support channels did not allow for the particularities of each case to be addressed. However, most affected users ultimately managed to reach human reviewers of automated decisions, after which their accounts were promptly restored. Almost none received a clear explanation for the suspension. The fact that suspensions occurred without evidence of violations of platform rules suggests a heavy reliance on automated decision-making in platform governance.

While many accounts were suspended following an apparent surge in inauthentic followers (Radar, Nova.rs), some were suspended without such growth (CRTA), and at least one outlet experienced a spike in suspicious followers without being suspended (Zoomer).

The first wave of this type of attack was recorded in mid-November 2025, when several Instagram accounts belonging to protesting students gained thousands of new followers in a short period, prompting students to alert the public. The community quickly mobilised and contacted Meta, while SHARE Foundation triggered an alert through the Digital Security Helpline operated by our partner organisation Access Now. The suspended accounts were restored the same day.

The next attack occurred in mid-January, this time primarily targeting Instagram accounts of independent media, journalists, activists and civil society organisations. Some twenty accounts were suspended, including those of media outlets such as Radar and Nova, as well as the organisation CRTA. SHARE Foundation and the wider community again alerted international partners and colleagues, and the suspended accounts were soon restored. A week later, Instagram accounts belonging to United Media outlets – TV N1, Nova.rs and Radar – again experienced a sudden mass influx of followers. At that point, according to Nova.rs Instagram statistics, as many as one third of its followers were based in India.

A third wave was recorded over the last weekend of January 2026, targeting the accounts of exiled activist Mila Pajić, student activist Lazar Stojaković, the local outlet Ozonpress.net from Čačak, and the leader of the opposition movement Kreni-Promeni.

International reactions

On Thursday, European organisations within the Media Freedom Rapid Response (MFRR) mechanism – tasked with monitoring and responding to media freedom violations in EU Member States and candidate countries – also issued an official statement. The statement warns that the recorded incidents form part of coordinated attacks on the free flow of news and independent information in Serbia, which remains in a period of media freedom crisis. Among the signatories were the European Federation of Journalists (EFJ), the International Press Institute (IPI), and the European branch of ARTICLE 19.

The statement describes the incidents as a worrying new form of digital censorship in Serbia and stresses that the ease with which platform flaws can be exploited requires the introduction of additional safeguards. The organisations called on Meta to apply obligations established under European Union law in EU candidate countries.

These obligations stem from Articles 16 and 17 of the Digital Services Act, which require platforms to promptly inform users of any restriction or suspension of their accounts or content and to provide clear and specific reasoning, including the legal basis for such decisions. Article 18 of the European Media Freedom Act requires very large online platforms to engage with media outlets prior to removing editorial content.

Since the 1 November 2024 tragedy at the Novi Sad Railway Station, in which 16 people lost their lives, Serbia has faced a sharp increase in digital repression against journalists, activists and civil society organisations. For the first time, Serbia was rated “partly free” in the Freedom on the Net 2025 report.

In Serbia’s tightly controlled media environment, social media plays an undeniable role in organising civic protests and informing the public, which is why students, media outlets and civil society actors are increasingly exposed to coordinated digital pressure.