From TikTok to WhatsApp: “Business” accounts, disappearing messages and groups with hundreds of participants where only administrators can post
Of the more than 500 profiles we found, we spoke with 13 of them: more than half (8) directed us to encrypted channels, with WhatsApp being the preferred option. Six asked in their profile descriptions or through TikTok direct messages that they be contacted via this messaging application in order to continue the conversation.
“WhatsApp has one central advantage: it is widespread and part of everyday life, especially in Spain and Latin America,” explains David Montero, coordinator of the Master’s Degree in Cybercrime at the International University of La Rioja. “That familiarity reduces friction,” he adds. According to 2026 data from Spain’s National Commission on Markets and Competition, 94.6% of users in Spain regularly use WhatsApp. In Latin America, it is also the dominant messaging application, according to a 2026 Infobip report.
Once on WhatsApp, we observed that users mainly interacted with those who contacted them in two ways: through one-to-one chats or through groups with hundreds of participants. Among the profiles operating through individual chats, we found that two were configured as WhatsApp Business accounts: a version designed, according to Meta, to “facilitate interactions with customers by offering tools to automate, organise and quickly respond to the communications you receive”.
One of these users, who described themselves as “a women’s clothing shop”, was available at all hours every day of the week (according to the information displayed on their profile), and their messages were configured to disappear 24 hours after being sent. When we contacted them, they did not offer clothing: “Hey, we’re active + 🍓. How many g [grams] do you want?” (sic). The message included a price list ranging from one gram of tusi for 35 Peruvian soles (around €9) to five grams for 125 soles (around €32), together with a video showing several bags of pink and light-blue powder.
The other profile encouraged us to “check out their catalogue”, a WhatsApp Business feature which “works like a mobile shop for your business”. Through it we could add products to a cart, as if shopping in a supermarket: one gram of tusi for 70 soles (€18), as well as other drugs such as LSD and “happy pills”. When we asked about delivery methods, they stopped responding.
Another account, which was not configured as a business profile, replied with a sticker showing numerous bags of tusi and two Pink Panther videos. One of them displayed, over an image of the cartoon character, a price list beginning with one gram for 100 Venezuelan bolivars (just over €7) and going up to one kilogram for 1,000 bolivars (€74). The other piece of content advertised a “cook’s kit” containing ketamine, “two pills”, “an essence” and 40 ziplock bags for approximately €55.
On WhatsApp, we also found groups being used to sell tusi. One of them, with 578 members whose phone prefixes came from different Latin American countries, had messages configured to disappear after 90 days and allowed only administrators with Peruvian phone prefixes to post messages. David Montero explains that this is “useful for controlling the message, avoiding noise, preventing uncomfortable questions and maintaining an asymmetrical relationship with potential buyers”.
Once we had been accepted into the group, we were sent a series of PDF documents titled ‘Basic Tusi Cooking’ and ‘Pablito Astral Recipe’, containing instructions and lists of ingredients for preparing this drug at home. We also received another document called ‘Astral Cook’s Kit’, advertising different drug “packs”, including ketamine, LSD and poppers, together with their prices in soles, dollars and euros. “If you are abroad, via DHL or FedEx,” the document stated. “Any purchase is handled privately with me, people” (sic), one of the administrators wrote in the chat.
Maldita.es contacted Meta, WhatsApp’s parent company, to ask what measures it has in place to prevent its platform from being used for the buying and selling of drugs. The company referred us to its WhatsApp Messaging Guidelines page, where it states that it prohibits, among other things, organising or coordinating the “trafficking of illegal drugs”. When violations are identified, the company states on its website that it may “temporarily or permanently suspend an account”, “remove information about offending accounts” and “prevent or block the use of invitation links”, among other measures.
What about Telegram? €85 recipes in channels accessed through TikTok bios that do not allow screenshots
At Maldita.es we have previously warned about the use of Telegram for various criminal activities, including the exchange and sale of child sexual abuse material. “Telegram offers other advantages: large channels, groups, searchability, aliases, less need to expose a phone number in certain contexts, bots, and a perception — sometimes exaggerated — of anonymity or impunity,” explains cybercrime specialist David Montero.
Only two of the 13 profiles we spoke to redirected interested users directly to Telegram: both did so by linking to their channels in their TikTok bios. One of these channels, with 200 subscribers, does not allow screenshots of its chat content, a feature provided by Telegram and not by other platforms. The first video sent through the channel showed a hooded man alongside the message: “100% reliable RECIPE, FOR ALL COUNTRIES. PDFS + COMPLETE 30:04-MINUTE VIDEO 🇦🇷 🇦🇲 🇪🇨 🇩🇪 🇪🇸 🇲🇽” (sic). The channel also had a pinned message directing users to another “references” channel where supposed testimonials from customers “satisfied” with their purchases were posted.
When we contacted the user via direct message, they told us that the tusi recipe also included “easy access to the supplies (that is, the drugs needed to make it) + a support video call” for a price of €85. To obtain the drugs required for the preparation process, they assured us that they could put us in touch with someone in Spain who could help us acquire them through “cash on delivery”, meaning that payment would be made directly when the package arrived at our home.
Another Telegram channel had only 3 subscribers when we joined (however, as of 26 August 2026, that number had risen to 41). There, the administrator posted a photograph of a ceramic plate containing light-blue powder alongside a message stating: “We’re active, my people 🍇. We have promotions every day” (sic). In subsequent messages, they stated that they also had “marijuana and cocaine” and that they accepted “orders by private message”. In a conversation with Maldita.es, Telegram stated that “the promotion and sale of illicit substances are explicitly prohibited under Telegram’s Terms of Service, and such content is removed as soon as it is identified.”
Whether on Telegram or WhatsApp, cybercrime expert Javier Sanz points out that these activities tend to end up on encrypted platforms because “they move the transaction to a surface where the gatekeeper cannot see the content: TikTok provides visible reach, while WhatsApp and Telegram provide invisible closure”.
Experts warn that this makes criminal investigations more difficult because the chain of evidence becomes fragmented. “The operation does not take place in a single space: one part is public or semi-public on TikTok, another occurs through private messages, another on WhatsApp or Telegram, and another, perhaps, offline,” says Montero.
Those operating on TikTok: “less sophisticated” profiles that offer their products directly on the social network
Not all the users we spoke to attempted to move us away from TikTok to communicate through a platform such as WhatsApp or Telegram. Five of them, who did not provide alternative contact channels in their biographies or simply wrote “message me”, kept their conversations within the platform’s direct messaging system. Why? “These may be less sophisticated profiles, more impulsive, or individuals with a lower perception of risk,” explains Montero. According to the expert, other possible explanations are that they may feel protected by the sheer volume of activity on the platform or that they may be “opportunistic sellers, scammers or low-level intermediaries rather than complex criminal structures”.
From promises that they could send products to us by car or by “post”, to offers to sell us “blue or green soloket keta for 200”, these profiles quickly moved towards completing a transaction. Three of them were located in Spain, according to the information available on their TikTok accounts. One assured us that if we bought more “stuff”, the price could be reduced. Another sent us their price list directly: “Kt [ketamine] 5, micro [LSD] 5, pills [MDMA] 3.5”. “For anything else, tell me what you’re looking for and I’ll give you a price” (sic).
Giving away the recipe as an “investment” to grow the business
One of the users we spoke to directly through TikTok gave us a recipe for preparing tusi at home in exchange for following them on the platform. In one of the WhatsApp groups, we received two documents containing step-by-step instructions for doing the same immediately after joining, without even requesting them. This is not an isolated phenomenon: throughout our investigation, we found 59 profiles promising to give away their recipes for preparing this drug.
For David Montero, this amounts to a kind of “informal franchise model”: “The seller does not limit themselves to distribution, but instead attempts to create new small-scale distributors, recruit intermediaries and expand their network.” According to the expert, this allows them to monetise tutorials, support services or ingredients, reduce their own direct exposure and generate dependency. “By presenting it as a tutorial or training, the barrier to entry is lowered: someone who may previously have had no contact with trafficking networks can come to perceive that learning, producing or selling is easy.”
“The right question is not ‘why do they give it away?’ but rather ‘what do they buy with that gift?’” says Javier Sanz. For him, it represents an investment: “If we look at it on a larger scale, this makes even more sense: those who sell MDMA and ketamine give away recipes for free, so anyone can set up a kitchen [start producing tusi] and launch their own brand. New micro-brands emerge, consumption increases, and as consumption grows, demand for MDMA and ketamine also increases.”
This article features the superpowers of David Montero, coordinator of the Master’s Degree in Cybercrime at the International University of La Rioja, and Javier Sanz, a criminologist specialising in cybercrime.
Thanks to your superpowers, knowledge, and experience, we can fight harder and better against lies. The Maldita.es community is essential to stopping misinformation. Help us in this battle: send us any hoaxes you come across to our WhatsApp service, lend us your superpowers, spread our debunkings, and become an Ambassador.
Methodology
From the sample of 504 unique TikTok users analysed for this investigation who claimed to sell tusi, drugs or ingredients for its preparation, as well as recipes for making it, we selected a random sample of 30 users from different countries and contacted them through the communication channels promoted on their profiles. In some cases they provided WhatsApp contact details directly; in others, links to Telegram or WhatsApp groups. When no direct communication channel was provided, we contacted them through TikTok direct messages.
All contact was made through an anonymous account on a mobile phone dedicated exclusively to this investigation. Of the 30 users contacted, only 13 replied or allowed us to enter these private spaces. In several groups, interaction was not possible, as only administrators were permitted to send messages. Where interaction was possible, we asked users about the products they sold, their prices and delivery methods. Once we had obtained the necessary information, we ended the conversation. Maldita.es did not complete any sale or exchange of any kind.
The location of the profiles mentioned in this article was determined by cross-checking the results of two tools: https://omar-thing.site/ and a bookmarklet designed by My OSINT Tools for Maldita.es. When the results did not match, we recorded the location that could be inferred from the published content, contact number and other user information. When the My OSINT Tools bookmarklet produced no results, we cross-checked the result from omar-thing.site against the information available on the profile.
If you have any questions, you can contact us at [email protected]