An Israeli company specialising in online influence operations appears to have provided training to Angolan officials on running coordinated social media campaigns, including the creation of fictitious accounts and state-promoting material, according to findings released by researchers at the University of Toronto's Citizen Lab.

BlackCore, which markets itself as "an elite influence, cyber, and technology firm built for the modern era of information warfare," initially pitched the Angola engagement as a four-week intensive course. The programme ultimately ran for 14 weeks and combined instruction with live campaign work, according to documentation reviewed by Citizen Lab.

Throughout the initiative, participants generated over 40 pieces of content while instructors assessed at least 24 publications. The work encompassed paid advertising on Facebook and Instagram as well as a TikTok operation.

The objective centred on what BlackCore termed "positive government campaigns," designed to frame the Angolan administration "in a positive light" rather than simply attacking political opponents, according to Alberto Fittarelli, a senior researcher at Citizen Lab.

A fabricated news outlet branded "Agita News" served as the hub of the effort, operating a Facebook page that published original material and republished content from an external website. Both platforms have since been taken down.

BlackCore's promotional materials highlighted more expansive capabilities, including the ability to furnish clients with hundreds of artificial personas, termed "avatars," distributed across major social platforms. The firm's offerings encompassed flooding platforms with synchronised messaging, amplifying engagement from genuine users and countering competing narratives through targeted material.

Assessing whether such operations genuinely shifted public sentiment presents methodological challenges, but BlackCore demonstrated strong interest in documenting the Angola campaign's reach, the researchers noted.

Internal reports submitted by the company included screenshots of deceptive posts achieving approximately 20,000 likes on Facebook, per Citizen Lab's analysis. Posts that remained publicly visible subsequently accumulated roughly 50,000 likes—"substantial amounts in a country with an estimated six million active Facebook users."

Although Citizen Lab could not independently verify that the training occurred or identify which Angolan officials took part, the convergence of internal records and digital infrastructure discovered by the researchers rendered it "highly likely" that the operation unfolded as BlackCore represented.

The researchers told Recorded Future News they uncovered no information regarding how BlackCore secured the contract, whether the Angolan government paid the firm directly or the engagement's financial terms.

Following the training sessions, which likely commenced in February, BlackCore removed its websites and social media profiles from public view. Citizen Lab reported difficulty locating current contact information for the company to request a statement, and the Angolan government declined to respond to inquiries from Recorded Future News.

Broader operations

BlackCore's operations have previously attracted attention from European regulators.

In June, Viginum, France's foreign-interference monitoring body, identified an information campaign directed at the left-wing France Unbowed party and certain candidates during municipal elections that displayed technical signatures connected to Israeli operators, including BlackCore. The effort deployed websites and coordinated profiles across multiple platforms to undermine candidates and amplify political polarisation.

French authorities stated they were unable to establish who initiated the operation.

Viginum subsequently indicated that BlackCore faced suspicion of involvement in interference activities targeting elections or political audiences in New York, Scotland, Angola and Togo.

In an August threat assessment, Meta reported dismantling a coordinated network based in Israel that reached audiences in Angola and multiple other nations. According to Citizen Lab, the network was highly probably operated by BlackCore.

The Angola situation demonstrates how administrations can increasingly purchase pre-built systems and technical expertise for concealed online influence campaigns from commercial service providers, Citizen Lab concluded.

BlackCore's pitch for Angola outlined what it characterised as a "professional, robust, and scalable" framework for government communications, the researchers noted.

"It is not highly common" for contractors to instruct their clients in executing influence operations independently, Fittarelli remarked to Recorded Future News, as opposed to executing campaigns on the clients' behalf.

"Training clients to run their operations independently has been historically observed as a likely way to evade detection," he added.