---
title: "From Malmesbury to Umhlali, SA has now seen both faces of nihilistic violent extremism"
description: "Two cases this year show that nihilistic violent extremism is no longer a foreign phenomenon. The more recent incident in Umhlali carries the hallmark characteristics of nihilistic violent extremism, a threat which other countries are already addressing."
type: "NewsArticle"
publisher: "Daily Maverick"
site: "https://www.dailymaverick.co.za"
section: "WARNING SIGNS OP-ED"
authors:
  - name: "Isel van Zyl"
    url: "https://www.dailymaverick.co.za/author/isel-van-zyl/"
  - name: "Amiee Taylor"
    url: "https://www.dailymaverick.co.za/author/amiee-taylor/"
canonical_url: "https://www.dailymaverick.co.za/article/2026-10-18-from-malmesbury-to-umhlali-sa-has-now-seen-both-faces-of-nihilistic-violent-extremism/"
published: "2026-10-18T23:08:49"
lang: "en-ZA"
word_count: 1458
---

# From Malmesbury to Umhlali, SA has now seen both faces of nihilistic violent extremism

> Two cases this year show that nihilistic violent extremism is no longer a foreign phenomenon. The more recent incident in Umhlali carries the hallmark characteristics of nihilistic violent extremism, a threat which other countries are already addressing.

By Isel van Zyl and Amiee Taylor · Published 19 October 2026, 01:08 SAST

## Key points
- Two 2026 cases — the Malmesbury online exploitation investigation and the Umhlali school attack — show that nihilistic violent extremism has reached South Africa in both networked and lone-actor forms.
- Unlike traditional terrorism, NVE is driven by notoriety, shock value and online status, often involving children, gamified cruelty and admiration for past mass killers.
- Warning signs around the alleged Umhlali attacker — including a failed mall bombing, intimidation arrest and violent manifesto — were reportedly visible, yet no institution clearly owned the risk.
- The authors call for behavioural threat-assessment teams, clearer prosecution rules, international cooperation and more responsible media coverage that denies perpetrators the notoriety they seek.

## Content

In a [Daily Maverick article](https://www.dailymaverick.co.za/article/2026-09-15-violence-without-a-why-a-shocking-online-terror-network-reaches-south-africa/) published almost exactly a month ago, we argued that nihilistic violent extremism (NVE), violence driven by status and shock value rather than ideology, had reached South Africa. The article served almost as a public service announcement, urging South Africa to start a conversation before a domestic case study forced one. We pointed then to a single local case, and to a chain of copycat school [attacks in Italy](https://ctc.westpoint.edu/a-domestic-mimetic-chain-nihilistic-violent-extremism-youth-radicalization-and-school-violence-in-italy/) as a warning of where the phenomenon can lead. A month later, South Africa had its own version of that second warning, and has now met NVE in both of its forms.

The first is the “networked” form, seen in the [Malmesbury case](https://www.enca.com/news/teen-linked-international-child-sexual-abuse-ring-faces-over-11-charges) we flagged in September. A 16-year-old arrested in August after a joint operation with the FBI and US Homeland Security is accused of [links to 764](https://www.ic3.gov/PSA/2025/PSA250306). He now faces 11 charges, including sexual exploitation, possession of child sexual abuse material, animal cruelty and making threats, and on 6 October he was found fit to stand trial. Yet 764 is only the best-known of dozens of nodes in the Com, a [decentralised online network](https://ctc.westpoint.edu/remotely-coerced-violence-764-the-com-network-and-the-hybridization-of-threats/) whose subgroups range from hacking and extortion to coercing children into self-harm and violence. Treating 764 as the whole of NVE is like hearing “terrorism” and thinking only of al-Qaeda.

The second is the lone-actor form. On 13 October a teenager allegedly forced his way into a classroom at a church-run school in Umhlali, on the KwaZulu-Natal North Coast, and attacked a six-year-old girl, who remains in a critical condition. He has been charged with attempted murder and assault. According to [The Witness,](https://witness.co.za/news/2026/10/13/six-year-old-stabbed-teen-suspect-previously-linked-to-alleged-kzn-bomb-plot/) he is the same teenager who allegedly left a homemade bomb in the food court of the [Ballito Junction mall](https://witness.co.za/news/2026/07/08/teens-alleged-manifesto-reveals-ballito-mall-bomb-plot/) in March, which failed to detonate. A manifesto attributed to him praised mass killers, including the [Columbine shooters](https://www.citizen.co.za/north-coast-courier/news-headlines/local-crime-news/2026/07/08/ballito-mall-bomb-teens-manifesto-reveals-alleged-plan-behind-failed-attack/), named the TikTok-based True Crime Community as an inspiration and reportedly set out a plan for a mass-casualty attack.

These cases look different, but they belong together. In networks such as 764 and the [wider “Com”,](https://www.ic3.gov/PSA/2025/PSA250723-3) status inside the group is earned by producing ever more extreme harm. The True Crime Community works differently: it is a fandom that treats mass killers as celebrities. The [Institute for Strategic Dialogue](https://www.isdglobal.org/digital-dispatch/how-the-true-crime-community-generates-its-own-killers/) has linked it to at least nine attacks and 16 disrupted plots since early 2024, including the school attack in Graz, Austria, in June 2025 that killed 11 students. The wider picture is larger still: the NVE Tracker run by the American University’s [Polarization and Extremism Research and Innovation Lab](https://perilresearch.com/projects/the-nve-tracker-and-dashboard/), has coded nearly 600 incidents in 42 countries since 2011, ranging from attacks and foiled plots to the exploitation of children. What the two forms share is the absence of a coherent political goal, violence staged for an online audience and perpetrators who are often still children.

### The warnings were there

What should worry South Africans most is not that NVE has arrived but how the system responded when it did. The Malmesbury case came to light because foreign agencies flagged it. In Ballito, the warning signs were not hidden. There was the undetonated device in March and, according to the police, an [arrest for intimidation in April](https://iol.co.za/news/south-africa/kwazulu-natal/umhlali-school-horror-kzn-police-arrest-teen-after-girl-6-stabbed-repeatedly/). In September we described the combination that should prompt real concern: a fixation on past attackers together with talk of a target or a plan. The manifesto reportedly contained both, and it was reported in local and regional media in July.

That same month, Dr Gérard Labuschagne, formerly the head profiler of the South African Police Service (SAPS) and now a threat assessment specialist in Canada, [told the North Coast Courier](https://www.citizen.co.za/north-coast-courier/news-headlines/local-crime-news/2026/07/15/dr-gerard-labuschagne-ballito-junction-mall-bomb-suspects-manifesto-shows-mass-violence-warning-signs/) that the manifesto resembled material written by people planning targeted mass violence. While stressing that he had not assessed the teenager himself, he described the apparent involvement in the True Crime Community as exceptionally concerning. He called for a competent violence risk assessment and for terrorism charges to be considered. He also warned that an arrest does not end the threat if the grievances behind it remain or deepen.

We do not know what assessment was done after March, if any. That uncertainty is itself the problem: no institution is visibly responsible for a child who shows these warning signs.

### Why NVE falls through the cracks

Each case has been filed under an existing heading. Malmesbury is being handled as child sexual exploitation, and Umhlali as school violence. Both labels are accurate, but neither captures what links the cases, so the pattern stays invisible. Belgium has run into the same blind spot. Christophe Busch, a Belgian radicalisation expert, [told The Brussels Times](https://www.brusselstimes.com/2297658/the-gamification-of-violence-how-nihilistic-extremism-is-seducing-young-people) that such cases are routinely handled as animal cruelty or as cybercrime, so the extremist current underneath goes unrecognised. Belgium’s threat assessment agency accepts that it must allow for significant under-detection.

Since its 2022 amendment, the [Protection of Constitutional Democracy against Terrorist and Related Activities Act](https://lawlibrary.org.za/akn/za/act/2004/33) no longer requires a political or ideological motive: violence intended to intimidate the public or spread fear can qualify. On paper, nihilistic violence may already be covered, but no South African prosecutor has yet tested it. The [Child Justice Act](https://www.gov.za/documents/child-justice-act) rightly prioritises diversion and rehabilitation for children. It was not designed, though, with a teenager who has written a manifesto and built a bomb in mind. Meanwhile, schools, social workers, mental health services and the police each see only a fragment of the picture.

![Gamer plays the game on a PC. View from the back. Low light scene with purple back light](https://cdn.dailymaverick.co.za/i/WkpWd9WT54s40BDsqBuiJQLyyIY=/200x100/smart/filters:strip_exif\(\)/file/attachments/orphans/oped-vanzyl-terrorism_962012.jpg)

*Modern terrorism has evolved into nihilistic violent extremism that works through decentralised networks and exploits children through online sextortion and gamified cruelty. (Photo: iStock)*

### What others have learnt

Countries that have been dealing with this threat for a while have learnt that ideology is a poor filter. In the [UK, 56% of referrals to the Prevent Programme in 2024-25 involved no identifiable ideology](https://www.gov.uk/government/statistics/individuals-referred-to-prevent-to-march-2025/individuals-referred-to-and-supported-through-the-prevent-programme-april-2024-to-march-2025), and about half concerned children aged 11 to 17. [In Australia, the Australian Security Intelligence Organisation said in late 2024](https://www.sbs.com.au/news/article/shocking-rise-in-australian-teens-being-radicalised-online/h5onlx29w) that one in five of its priority counterterrorism cases involved a young person. The Australian Federal Police has since joined a Five Eyes law-enforcement group set up to disrupt the networks targeting children. Several Australian states also run multi-agency programmes that bring police, psychologists, schools and families together around a young person before any crime is committed.

### What South Africa needs

South Africa does not need to import these models wholesale, but three steps would close the most dangerous gaps.

First, South Africa needs a [behavioural threat-assessment capability](https://gnet-research.org/2026/02/17/beyond-extremism-platform-responses-to-online-subcultures-of-nihilistic-violence/) for young people that focuses on conduct rather than ideology, as the Institute for Strategic Dialogue recommends. A small team drawing on the SAPS, Basic Education, Social Development and clinical psychologists would give schools, parents and police somewhere to refer a concerning child, and would keep following that child after an arrest. Belgium already runs local units on this model. Second, the National Prosecuting Authority should clarify when NVE conduct meets the threshold of the anti-terrorism law, and how Child Justice Act diversion applies to children who plan mass-casualty violence. Third, South Africa should build formal channels into the agencies in Canada, Australia and the US that have tracked these networks for years, while developing its own capacity to investigate online harm, rather than waiting for the next foreign tip-off.

Finally, the media need to be cautioned on the potential role they can play in perpetuating the threat. [Notoriety is the currency](https://www.crisisreadymedia.org/NVE) of the True Crime Community, and the Ballito case shows how easily South African coverage can supply it. After the failed mall bombing, the teenager acquired a [catchy nickname in headlines](https://podcasts.apple.com/ch/podcast/ballito-bomb-boy-stabs-6-year-old-girl-in-school-attack/id1441394221?i=1000796162021&l=it) in July, and it resurfaced on the day of the Umhlali attack. Labuschagne noted that the manifesto reflected a [wish for notoriety](https://www.citizen.co.za/north-coast-courier/news-headlines/local-crime-news/2026/07/15/dr-gerard-labuschagne-ballito-junction-mall-bomb-suspects-manifesto-shows-mass-violence-warning-signs/) and an urge to copy earlier attackers. For someone with those motives, a media nickname is a reward. In September we described how researchers traced a “mimetic chain” of school attacks in Italy, each one inspired by the last, and the Institute for Strategic Dialogue warns that coverage of attackers encourages others to seek the same recognition. Responsible reporting means no nicknames, no quoting from manifestos, and keeping the focus on victims and on the failures that allowed the attack.

South Africa no longer needs to ask whether nihilistic violent extremism will reach it. The question now is whether the next warning sign will land on the desk of someone who recognises it, and who has the authority to act. **DM**

*Isel van Zyl is a researcher and project manager specialising in violent extremism, conflict and human security. Amiee Taylor is a sociologist whose research focuses on violent extremism, online radicalisation and extremist subcultures. Her interests include the role of ideology, identity and conspiratorial narratives in extremist movements, particularly the intersections between religious beliefs and extremist ideologies.*