Following weeks of investigation, editors who work on the English version of Wikipedia blocked 381 user accounts for “black hat” editing. The accounts were engaged in “undisclosed paid advocacy” – a term used for editors who create fake pages and promotional articles using misinformation on existing pages on Wikipedia, and promise to protect those pages in exchange for a free without revealing their affiliation, in violation of Wikimedia’s Terms of Use.

Essentially, hackers were hired to spread misinformation across pages on Wikipedia.

So far, more than 200 pages have been pulled down by the online encyclopedia, following weeks of the investigation codenamed “Orangemoody.” Wikipedia described such duplicitous activity as “sockpuppetry”, where multiple user accounts are inappropriately used.

It’s unknown, who is behind the attack. According to a spokesperson for the Wikimedia Foundation, the organization that runs Wikipedia, it’s a little too preliminary to divulge details at the moment. Although, the list of pages Wikipedia has since deleted can be found by searching “Wikipedia:Long-term abuse/Orangemoody/Articles.”

Most of the pages, more than 210 articles appear to be for fake notable people, artists or businesses. These articles have since been removed on the basis that they were generally promotional in nature and included skewed or biased information, as well as unattributed material and potential copyright violations. Wikipedia editors are still reviewing other changes made by the hacking group to determine if existing pages should be simply deleted or edited.

The edits made by these accounts were similar to each other, leading editors to a common theory that a single hacking group could be behind it.

The accounts in question followed an odd pattern:

  • A fresh article draft being declined by the community, usually due to reasons such as notability concerns or because of excessively promotional content.
  • A user account would generally begin working on an article, using original contributors’ content, developing it sufficiently for reviews. An external contact would then be made with the article’s subject, or with the original draft creator. An offer would then be made to publish the article for a fee. The person making the contact would usually claim to be an experienced editor or administration in the Wikipedia community, and would often pose as a well-known editor or administrator.
  • Money would then be exchanged. The article would then be moved to article space, where it would then be reviewed by another fake user from the same gang.
  • Later, the person who paid for the article would be contacted again and promised that the editors will continue to protect the article from vandalism or deletion for a specific monthly free in return.

A similar issue came out in the spotlight in 2013 when it deleted hundreds of accounts for undisclosed paid advocacy. Fake pages brimming with biased content, articles disparaging an opponent, and information framed in an advantageous way could mislead the roughly 500 million users who visit Wikipedia each month, and trust everything written by editors. The blocks are issued to ensure Wikipedia is an accurate, trusted, and neutral knowledge resource for everyone.