Cross-Platform Tactics, Techniques, and Procedures

Nisos identified operators (see source 1 in appendix) using common TTPs across traditional social media platforms:

Avoiding on-platform overt advertising and sales by providing off-platform redirects to messaging apps, including Telegram, Snapchat, and Wickr.

Promoting pharmaceuticals available without a prescription and directing potential buyers to off-platform domains for purchases through illegitimate online pharmacies.

The use of coordinated inauthentic behavior (CIB) to attract potential buyers.

Sellers in the same network operating accounts across multiple social media platforms are likely to reach a wider audience.

Use of common drug names in posted content and account information, as drug names are searchable across the majority of traditional social media platforms.

Various prescription drugs available for purchase, indicating the sellers are likely not offering their own prescription medication.

Off-Platform Redirects to Messaging Apps

When marketing prescription drugs on a specific traditional social media platform, sellers are very likely negotiating the actual sales off platform based on off-platform redirects to various messaging apps and the lack of pricing information on platform. The most common off-platform redirects included Telegram, Snapchat, Wickr, and email. Nisos assesses operators provide off-platform redirects to avoid content moderation and prevent account suspension for violating platforms’ TOS.

Graphic 1: Sample of pharmaceutical-related social media accounts’ posts
directing potential buyers off platform, where they very likely conduct drug transactions.

Graphics 2 and 3: X account directs users to the Telegram channel
Psychedelic store 420 (dyzxand). (See source 2 in appendix)

Nisos observed the term “teleplug,” often displayed as “tele🔌,” short for “Telegram plug.” “Plug” is a slang term describing a high-level drug dealer who deals in larger quantities and a wide variety of pharmaceuticals and illicit substances, alluding to the dealer’s connections. Social media content promoting Telegram accounts or channels selling prescription drugs frequently uses the hashtags teleplug, tele, plug, and/or pluggedin in combination with prescription drug slang or nicknames. The content frequently features photos or videos of drugs, delivery arrival videos from customers, and customer testimonials verifying the seller’s completion of orders. The most common pharmaceuticals associated with “teleplug” were Xanax, codeine, and OxyContin.

Graphics 4 and 5: Video featuring the “teleplug” emoji symbol advertising the Telegram channel
@strxghtjxcket (top). The video features a positive feedback message regarding a successful
Adderall delivery. The video poster used hashtags associated with teleplug and their Telegram channel (bottom).

Illegitimate Online Pharmacies

Nisos discovered accounts self-identifying as pharmacies and promoting the sale of various pharmaceuticals. Nisos identified these accounts by searching variations and combinations of pharmacy, available and online, alongside the pharmaceutical of interest. These terms frequently appear within accounts’ display names, usernames, and content captions. The pharmacy accounts direct users off platform—typically to domains with display names resembling their usernames—to purchase the promoted pharmaceuticals without a prescription. Many of these illegitimate pharmacies are located worldwide and are not limited to any specific region.

To obtain the complete research report, including endnotes, please click the button below.