How South Africa’s xenophobic online machine was rebooted in 2026

South Africa’s latest wave of xenophobic mobilisation did not begin with a political speech or a major violent incident. It began with a missing-person campaign.

Yet this resurgence would not have been possible without the groundwork laid by a movement that has spent the past six years building audiences, networks and narratives around anti-immigrant mobilisation, dating back to the emergence of #PutSouthAfricansFirst during the Covid lockdown period in 2020.

In early 2026, emotional online appeals linked to the disappearance of Mazwi Kubheka spread rapidly across X under hashtags such as #BringMazwiBack and #JusticeForMazwi. Initially framed as community-driven efforts to find a missing young man, the campaigns quickly evolved into something much larger: a digitally coordinated anti-immigrant mobilisation ecosystem.

Although authorities later stated that the alleged kidnapping involved both South African and foreign-national suspects, including individuals of Ethiopian origin, investigators stressed that the case remained open and that the full motive had not yet been established.

A national social media cause

Online activists nevertheless increasingly used the case as evidence for broader claims linking undocumented migration to crime, corruption and state failure.

A key early champion of the Mazwi campaign was X user @radebe_merci, whose persistent posting helped transform the disappearance from a local missing-person case into a national social media cause. Radebe Merci, who works for alternative media outlet MDN News, became one of the most influential accounts associated with #BringMazwiBack and #JusticeForMazwi.

As engagement grew, the campaign was picked up and amplified by a broad coalition of nationalist influencers, anti-immigration activists, alternative media platforms and political commentators. What began as a search for a missing young man increasingly became a rallying point around wider grievances relating to immigration, crime and governance.

An analysis of a sample of almost four million posts on X between January and May 2026 shows how nationalist influencers, activist networks and coordinated amplification accounts transformed grief, fear and outrage into one of the country’s most powerful online anti-foreigner narratives.

At the centre of this ecosystem sat the X account @knick_rsa, followed by March and March leader Jacinta Ngobese-Zuma, while Herman Mashaba’s ActionSA-aligned community did the most to translate these online conversations into formal political engagement.

According to the analysis, the largest and most dominant online community was an Operation Dudula-aligned nationalist cluster built around @knick_rsa, responsible for 37% of all posts in the dataset despite representing only 15% of users – such a high level of posting by so few users is often a red flag for inauthentic coordinated behaviour. The network fused Operation Dudula rhetoric, anti-immigration activism and populist law-and-order messaging into a highly shareable online campaign structure.

The Mazwi campaign became a gateway issue. Missing-person appeals gradually merged with hashtags such as #Abahambe (“They must go”), #PutSouthAfricansFirst and #BanNigeriansInSA. Posts increasingly framed undocumented migrants as responsible for violent crime, kidnappings, drugs and state collapse.

What emerged was not simply a spontaneous public reaction. Multiple tightly coordinated “buzzer” cohorts were identified. These are networks of accounts that single-mindedly reposted the same influencers and hashtags in synchronised bursts designed to maximise visibility.

Among the most active were the #Abahambe hashtag promoters within the @knick_rsa community, as well as amplification cohorts boosting March and March leader, Ngobese-Zuma, and the #BringMazwiBack campaign.

The data does not say whether these were paid influence campaigns or merely passionate activists, although the signs are there in terms of the single-minded focus on amplifying key influencers, and the high number of average posts per user within communities such as @knick_rsa’s.

The campaigns that emerged through this dataset are highly interconnected. Missing-person activism, anti-immigrant marches, Home Affairs corruption allegations and township crime stories were repeatedly woven together into a single narrative framework, which says that South Africa is under siege from undocumented foreigners and an incapable state.

The strategy echoed dynamics previously identified in reporting on #PutSouthAfricansFirst, Operation Dudula and xenophobic nationalism, showing how this campaign has been built up over the past six years, starting in April 2020, just a month into the Covid lockdown. A recurring feature of this ecosystem has been its ability to transform emotionally charged incidents into broader political narratives.

In 2025, for example, anti-immigrant networks widely circulated claims that Vosloorus spaza shop owner Thulani Khumalo had been murdered by a “Somali syndicate”, only for later reporting to establish that he was alive. The incident illustrated the playbook: real fears, rumours and unresolved events are rapidly incorporated into anti-foreigner mobilisation before the facts are fully established.

By 2026, the infrastructure appeared more mature and digitally sophisticated. Organisers were leveraging a new generation of emotionally resonant viral campaigns, such as the Mazwi Kubheka case, to bootstrap engagement before redirecting audiences toward broader nationalist mobilisation.

Six years in the making

South Africa’s contemporary xenophobic movement did not emerge spontaneously. Its modern online form can be traced to the 27th of April 2020, when the hashtag #PutSouthAfricansFirst suddenly surged into prominence despite having virtually no presence the day before.

Among the most prominent figures amplifying the hashtag at launch were former Johannesburg mayor Herman Mashaba, who was in the process of launching ActionSA, and African Transformation Movement (ATM) leader Vuyo Zungula.

Mashaba has consistently argued that his concern is with undocumented migration rather than migrants generally, framing the issue as one of law enforcement, border control and state capacity, while rejecting accusations of xenophobia or formal association with anti-immigrant mobilisation. Nevertheless, his continued public alignment with prominent activists associated with the movement has remained notable.

The ATM, meanwhile, has long faced allegations that it was established with the backing of former president Jacob Zuma, although he has denied this. If those links are accepted, the movement’s early participation suggests a convergence between Mashaba’s anti-undocumented migration populism and strands of Zuma-aligned RET (radical economic transformation) politics.

Like Mashaba, Zungula has generally focused his public messaging on undocumented migrants, calling for stricter enforcement and prioritisation of citizens in the allocation of public resources. However, the company he keeps on X often presents a more complicated picture than his formal public statements alone.

Many of the personalities who helped establish the movement remain active today.

Zungula continues to play a central role in the ecosystem. Mario Khumalo’s South African First Party – an early adopter of anti-foreigner nationalist rhetoric – has played a key role in defining the movement. Their former spokesperson, “Victoria Africa” Mamogobo, is now a member of the Patriotic Alliance. In the early years, Herman Mashaba would repost her content, including this video referring to a “foreign invasion”.

Another South African First Party alum, Sifiso Gwala, became one of the movement’s most influential early digital organisers. Operating under aliases including “uLeratoPillay” and “MrHandsome”, Gwala used inflammatory and racist content to rapidly grow the online community aligned with the movement.

His tactics eventually led to platform bans, but multiple successor accounts bearing variations of the uLerato Pillay identity continue to anchor the anti-foreigner community today (including @nyebe_official and @LeratoPillayZA), espousing some of the most outspoken xenophobic rhetoric.

The movement itself has evolved through several identifiable phases.

Dogwhistles, political undercurrents

The first generation was primarily a digitally coordinated network built around accounts linked to Gwala. His MrHandsome account built the network through “follow trains” and his uLeratoPillay account provided the divisive content to activate it. This ecosystem was amplified by political actors including Mashaba and Zungula, who often used subtle dogwhistles to walk a tight line of plausible deniability, helping transform fringe online mobilisation into mainstream political discourse.

During this period, #PutSouthAfricansFirst also developed an offline counterpart in the form of Operation Dudula, which translated online rhetoric into real-world mobilisation. Like March and March’s Ngobese-Zuma, that movement was similarly led by a charismatic leader in the form of Nhlanhla “Lux” Dlamini before he had a change of heart regarding the nature and direction of the movement. Again, we see a playbook at play.

Observers have also pointed to deeper political undercurrents surrounding the movement. As mentioned above, Zungula’s ATM party has long faced allegations of close ties to former president Zuma and the RET faction of the ANC, with some analysts drawing parallels between the nationalist rhetoric surrounding the movement and the dynamics that fuelled the July 2021 unrest, but this is speculation. The movement’s recurring Zulu nationalist undertones have become increasingly pronounced over time, however.

Alternative media ecosystem

The second generation saw the expansion of an alternative media ecosystem around the movement. Anonymous and semi-anonymous platforms such as The Truth Panther, PSAFLive (Put South Africa First Live), and MDN News broadened the movement’s reach and helped sustain a constant stream of anti-immigrant narratives and political agitation that disintermediated the mainstream media.

While MDN News has been an anchor account in the anti-foreigner community in recent years, the absence of its official account in the current wave is worth noting (its only presence comes in the form of Radebe Merci’s initial championing of the Mazwi campaign).

Nationalist and networked

The third generation of the movement has been characterised by a more overtly nationalist and politically networked orientation, particularly through formations such as March and March and figures like Jacinta Ngobese-Zuma.

While branding and personalities have evolved over time, many of the movement’s core actors, amplification tactics and underlying narratives have remained remarkably consistent. What exists today is therefore not a new phenomenon, but the continuation of a long-running ecosystem built by many of the same personalities using many of the same methods, with increasingly serious real-world consequences for migrants and vulnerable communities across South Africa.

By 2026, the boundary between anti-immigrant street movements and formal electoral politics has become increasingly porous. ActionSA is no longer merely echoing anti-undocumented-immigration rhetoric from outside the movement; it is increasingly incorporating the movement’s organisers, public faces and adjacent influencer networks into its own political machinery.

Former Operation Dudula leader, Zandile Dabula, formally joined ActionSA after resigning from the movement, later becoming the party’s Johannesburg MMC candidate for Human Settlements. Herman Mashaba also publicly stated that ActionSA would “celebrate” March and March founder Jacinta Ngobese-Zuma becoming the party’s eThekwini mayoral candidate if she made herself available.

Former Sizok’thola presenter Xolani Khumalo was, meanwhile, unveiled as ActionSA’s Ekurhuleni mayoral candidate after increasingly aligning himself with anti-immigration activism, including public support from Ngobese-Zuma and participation in March and March-linked operations targeting alleged drug dens and undocumented migrants in KwaZulu-Natal and Gauteng.

In January, Ngobese-Zuma publicly mobilised March and March supporters to defend Khumalo at Katlehong police station after he faced legal complaints linked to anti-drug and anti-foreigner operations. Analysts increasingly accuse ActionSA-aligned figures of blurring the line between patriotism, vigilantism and xenophobic mobilisation, particularly as movements such as March and March adopt more militant rhetoric, including Zulu regiment marches and calls for mass deportations.

Engineering a national conversation

Returning to the current moment, posts linked to Mazwi Kubheka’s kidnapping were often paired with calls to “make noise”, “make this trend”, or amplify specific influencers and media outlets. Mainstream broadcasters, including Newzroom Afrika, eNCA and SABC News were persistently tagged, helping push fringe activist messaging into national conversation streams.

What the 2026 data ultimately reveals is how mature and deeply embedded this ecosystem has become. The rapid escalation around the Mazwi campaign was not an isolated viral moment, but the product of the years of network-building, audience cultivation and coordinated digital mobilisation discussed above, and that long predated the disappearance of Mazwi.

Returning to the data, repeated spikes in activity that appeared unusually coordinated were noted. Several cohorts posted in rapid succession around the same hashtags before engagement abruptly declined; patterns commonly associated with orchestrated amplification campaigns rather than organic discussion.

The online ecosystem around @knick_rsa did not operate in isolation. ActionSA’s Mashaba’s supporters, PSAFLIVE amplification networks and Ngobese-Zuma’s “March and March” activists all formed part of an overlapping digital sphere united by anti-immigration narratives and mobilisation calls.

Counter-voices do exist, particularly among EFF-aligned commentators who criticise xenophobia and accuse nationalist activists of scapegoating migrants for state failure. However, these responses are often reactive rather than agenda-setting.

The broader significance of these findings lies in how political narratives are constructed and scaled in South Africa’s digital ecosystem. What emerged around the Mazwi Kubheka campaign in 2026 was not a spontaneous eruption of public anger, but the latest phase of a network that has been developing for at least six years.

Many of the personalities, amplification networks and political currents that helped build the original #PutSouthAfricansFirst ecosystem remain active today and are increasingly being parlayed into a political platform. Some movements, slogans and public faces have evolved, but many others have remained the same.

A recurring playbook

The analysis suggests a recurring playbook. The first step is the creation of an interconnected online community. The second step is the cultivation of charismatic personalities capable of setting that community’s agenda around anti-immigrant narratives.

Over time, figures associated with #PutSouthAfricansFirst, Operation Dudula, March and March and related movements have become powerful agenda-setters in their own right, capable of rapidly mobilising large audiences.

The third step is the activation of the networked community through the appropriation of emotionally charged events before the facts are fully established.

Missing-person cases, crime incidents, business disputes and anti-drug operations are transformed into symbolic stories about foreign criminality and state failure, creating emotionally compelling entry points into broader nationalist mobilisation. The Thulani Khumalo case in 2025 and the Mazwi Kubheka campaign in 2026 both illustrate how unresolved incidents can be rapidly absorbed into anti-foreigner narratives long before investigations are concluded.

Sophistication

What has evolved is the sophistication of the mobilisation. Narratives that once existed on the fringes of social media have increasingly migrated into mainstream political discourse, alternative media ecosystems and even formal party politics. Emotionally charged events such as missing-person cases, crime incidents and anti-drug operations now act as catalysts that can be rapidly amplified, coordinated and redirected toward broader nationalist and anti-immigrant mobilisation at scale.

In 2026, the disappearance of one young man did not create South Africa’s xenophobic online machine. It revealed how entrenched, interconnected and politically influential that machine has already become. DM

Kyle Findlay is the co-founder of Murmur Intelligence.