---
title: Citizen Lab published BlackCore's Angola training file:a 14-week Israeli contractor course that taught state staff to run fake personas and a phantom news page.
url: https://propagandaarchive.org/briefs/20260917-1820Z-blackcore-angola-train/
description: On 17 September 2026 the University of Toronto's Citizen Lab published a research note by Alberto Fittarelli, John Scott-Railton, and Maia Scott on…
section: Watch briefs
---

![Illustration: a dossier collage of generic campaign-era posters, loudspeaker trucks and rally crowds.](https://propagandaarchive.org/static/generated/hero-campaigns.jpg)

[Watch briefs](https://propagandaarchive.org/briefs/) · September 17, 2026

# Citizen Lab published BlackCore's Angola training file:a 14-week Israeli contractor course that taught state staff to run fake personas and a phantom news page.

- **Filed:** September 17, 2026, 18:20 UTC
- **Actor:** BlackCore, an Israeli influence-for-hire contractor, training Angolan government communications staff; Meta later removed an overlapping Israel-origin CIB cluster
- **Target:** Angolan Facebook, Instagram, and TikTok users asked to treat Agita News posts and AI-faced neighbor accounts as independent civic speech for the government
- **Source:** Unidentified Source blurred: contractors, cutouts, buried disclosure
- **Confidence:** **high** Multiple independent open sources, low disagreement about the facts
- **Techniques:** [Astroturfing](https://propagandaarchive.org/techniques/astroturf/) [Narrative laundering](https://propagandaarchive.org/techniques/narrative-laundering/) [Synthetic media](https://propagandaarchive.org/techniques/synthetic-media/) [Manufactured consensus](https://propagandaarchive.org/techniques/manufactured-consensus/) [Disclosure theater](https://propagandaarchive.org/techniques/disclosure-theater/)
- **Where:** Angola, Israel, France
- **Channels:** Citizen Lab research note, 17 September 2026BlackCore final report and angola-plan.blackcore.online pageAgita News Facebook page and agitanews.netFacebook personas Dorivaldo Kiala and Gancho AtalaiaMeta and TikTok advertising workshopsMeta H2 2026 Adversarial Threat Report, 27 August 2026Viginum Rokh Solis reporting, June 2026The Record and OCCRP same-day writeups

## Summary

On 17 September 2026 the University of Toronto's Citizen Lab published a research note by Alberto Fittarelli, John Scott-Railton, and Maia Scott on BlackCore, an Israeli influence-for-hire firm. A source provided a final report matching BlackCore's now-removed angola-plan.blackcore.online page. The report says the program began 19 January 2026 and ran more than 14 weeks into April, training government communications staff and launching a supervised operation. Trainees produced more than 40 pieces of content; trainers scored 24 publications. A Facebook page for a fictitious outlet, Agita News, linked to agitanews.net; both are offline. Citizen Lab identified two seed personas, Dorivaldo Kiala and Gancho Atalaia, with high confidence as AI-generated faces. Meta's 27 August 2026 H2 threat report had already removed an Israel-origin CIB cluster that included Angola. Score the documents, dates, and fake-outlet stack as high. Score a confirmed Angolan treasury payment and a claim that every like was a bot as not shown.

## Analysis

The last two active briefs covered a Meta Oversight Board deepfake leave-up and a Flock-Neighbors astroturf stack. Rotation this cycle is contractor and state client: an Israeli influence-for-hire shop teaching an African government's communications team to run the shop themselves.

On 17 September 2026 Citizen Lab published the BlackCore note. Researchers mapped blackcore.online subdomains, including angola-plan.blackcore.online titled Angolan Government Campaign, then obtained a final report that matches that page. The report dates the work from 19 January 2026 through more than 14 uninterrupted weeks into April. The advertised four-week course covered storytelling, copywriting, traffic management, and social media operations, including a week-three Meta Ads and TikTok workshop. The document's own objective sentence is on the page: the non-negotiable objective of this cycle was the eradication of amateur production practices and the implementation of a professional, robust, and scalable Architecture for State communications. Scope is defined as positive government campaigns. Participants produced more than 40 pieces of content; trainers evaluated 24 publications and claimed high proficiency in strategy, visual structuring, and advanced audiovisual production and AI usage. A Facebook page for Agita News posted original copy and links to agitanews.net; both are offline. Citizen Lab named two seed identities with high confidence, Dorivaldo Kiala posed as an activist and Gancho Atalaia, both with AI-generated faces. Screenshots in the report show deceptive posts near 20,000 likes; some pages that lingered later approached 50,000 in a market of about six million Facebook users. Citizen Lab could not name the trainees or produce a payment path. It assesses the program as highly likely to have happened as the company described. Angola did not answer The Record. BlackCore's public sites are gone.

Meta's 27 August 2026 H2 report had already taken down 215 Facebook accounts, four Pages, and 1,044 Instagram accounts in an Israel-origin influence-for-hire cluster aimed at France, the United Kingdom, Australia, Iran, Togo, Gabon, Angola, and the United States. Operators used an in-house label, Mother-Child: AI comments under primary assets. Meta wrote anti-government messaging in Angola. Citizen Lab writes that it is not clear whether Meta misread the Angola cluster or BlackCore sold both sides. Viginum in June had already tied BlackCore infrastructure to France's municipal race and flagged Angola, Togo, Scotland, and the 2025 New York municipal race. Score the January-April file, the Agita News stack, the two named personas, and Meta's takedown table as high. Score a signed Luanda contract and a claim that every engagement was inorganic as not shown.

Mechanism is astroturf first. The warrant is a local face and a news masthead. The payload is government-positive copy written after a contractor taught the client's staff the production line. Narrative-laundering is Agita News: a title that looks like a desk, not a ministry. Synthetic-media is the face set and the AI comment layer Meta named Mother-Child. Manufactured-consensus is the like count offered as proof a neighborhood moved. Disclosure-theater is the whole costume: no FARA-style tag travels with the clip in Luanda, and the contractor's own sites vanish after inquiries.

This is propaganda on the method test where origin is a hired shop plus a state communications team, form is neighbor and newsroom speech, and the design goal is to move identification so paid alignment reads as unprompted civic noise. Gray color does not cancel the method. A same-method test applies in reverse. An African contractor that trained an Israeli ministry to seed AI-faced activists and a phantom outlet for the coalition, then wiped the shop page, would be this brief with the capitals swapped.

Literacy counter: keep three objects apart. One: the 19 January start date, the 14-week report, Agita News and agitanews.net, the two named personas, and Meta's August removal counts. Those are records. Two: Fittarelli's evasion-by-training line and Meta's anti-government Angola sentence. Those are assessments. Three: the instruction that object one proves every Angolan government post is a BlackCore asset, or that object two proves Israel the state commissioned Luanda. If the payload is two or three, the stack is still doing method work. If the payload is one, open the Citizen Lab note, the Meta H2 Angola paragraph, and the Viginum Rokh Solis page on the same screen.

## Tells

- A four-week comms course that becomes a 14-week live operation
- A news masthead with no staff and a domain that dies with the shop
- AI-generated activist faces used as seeders into local Facebook groups
- Training the client so the contractor is not the account owner at takedown
- Pro-government training notes against a platform report that listed anti-government Angola copy

## Literacy counter

Keep three objects apart. One: the 19 January start date, the 14-week report, Agita News and agitanews.net, the two named personas, and Meta's August removal counts. Those are records. Two: Fittarelli's evasion-by-training line and Meta's anti-government Angola sentence. Those are assessments. Three: the instruction that object one proves every Angolan government post is a BlackCore asset, or that object two proves Israel the state commissioned Luanda. If the payload is two or three, the stack is still doing method work. If the payload is one, open the Citizen Lab note, the Meta H2 Angola paragraph, and the Viginum Rokh Solis page on the same screen.

## Evidence

1. [Citizen Lab, 17 September 2026: BlackCore influence-for-hire note and Angola final report](https://citizenlab.ca/research/blackcores-influence-operations-for-hire/)
2. [The Record, 17 September 2026: BlackCore trained Angolan officials in online influence operations](https://therecord.media/angola-israel-influence-operations-blackcore)
3. [OCCRP, 17 September 2026: Israeli firm may have run Angola influence campaign](https://www.occrp.org/en/news/israeli-firm-may-have-run-angola-influence-campaign)
4. [Meta H2 2026 Adversarial Threat Report, 27 August 2026: Israel-origin CIB including Angola](https://transparency.meta.com/sr/H2-2026-adversarial-threat-report/)
5. [Viginum Rokh Solis analysis of the information modus operandi tied to BlackCore](https://www.sgdsn.gouv.fr/viginum/publications/rokh-solis-analyse-dun-mode-operatoire-informationnel-ayant-cible-les)
6. [Reuters, 12 June 2026: Viginum flags BlackCore activity in Angola, Togo, New York, Scotland](https://www.reuters.com/world/israeli-firm-blackcore-also-suspected-meddling-nyc-scotland-votes-french-2026-06-11/)

## Related briefs

- Sep 17, 2026Unidentified — [Meta left an unlabeled deepfake of a Scottish Labour councillor saying refugees are welcome even if they rape, until the Oversight Board ordered it down as hate speech.](https://propagandaarchive.org/briefs/20260917-1717Z-meta-oversight-deepfake/) — [Synthetic media](https://propagandaarchive.org/techniques/synthetic-media/) [Card stacking](https://propagandaarchive.org/techniques/card-stacking/) [Outrage bait](https://propagandaarchive.org/techniques/outrage-bait/) [Name-calling](https://propagandaarchive.org/techniques/name-calling/) [Disclosure theater](https://propagandaarchive.org/techniques/disclosure-theater/)
- Sep 17, 2026Unidentified — [Flock Safety partnered with a new D.C. nonprofit that used AI-gated texts to manufacture Knox County support for license-plate readers after commissioners moved to cancel the cameras.](https://propagandaarchive.org/briefs/20260917-1607Z-flock-neighbors-astroturf/) — [Astroturfing](https://propagandaarchive.org/techniques/astroturf/) [Plain folks](https://propagandaarchive.org/techniques/plain-folks/) [Manufactured consensus](https://propagandaarchive.org/techniques/manufactured-consensus/) [Synthetic media](https://propagandaarchive.org/techniques/synthetic-media/) [Card stacking](https://propagandaarchive.org/techniques/card-stacking/)
- Sep 17, 2026Unidentified — [France-Spain freelancers sold patriotic local pages so Moscow-Sahel military copy and anti-Ukraine lines could travel as community brands.](https://propagandaarchive.org/briefs/20260917-1300Z-france-spain-sahel-cib/) — [Astroturfing](https://propagandaarchive.org/techniques/astroturf/) [Narrative laundering](https://propagandaarchive.org/techniques/narrative-laundering/) [Manufactured consensus](https://propagandaarchive.org/techniques/manufactured-consensus/) [Card stacking](https://propagandaarchive.org/techniques/card-stacking/)