Social media have been deliberately used for malicious purposes, includingpolitical manipulation and disinformation. Most research focuses onhigh-resource languages. However, malicious actors share content acrosscountries and languages, including low-resource ones. Here, we investigatewhether and to what extent malicious actors can be detected in low-resourcelanguage settings. We discovered that a high number of accounts posting inTagalog were suspended as part of Twitter's crackdown on interferenceoperations after the 2016 US Presidential election. By combining text embeddingand transfer learning, our framework can detect, with promising accuracy,malicious users posting in Tagalog without any prior knowledge or training onmalicious content in that language. We first learn an embedding model for eachlanguage, namely a high-resource language (English) and a low-resource one(Tagalog), independently. Then, we learn a mapping between the two latentspaces to transfer the detection model. We demonstrate that the proposedapproach significantly outperforms state-of-the-art models, including BERT, andyields marked advantages in settings with very limited training data-the normwhen dealing with detecting malicious activity in online platforms.