Paid influencers and sockpuppets drove social media campaign targeting South African banks

Anti-racist rhetoric used as cover for a social media campaign targeting South African banks as they sever ties with local business empire

Paid influencers and sockpuppets drove social media campaign targeting South African banks

Share this story


(Source: @jean_leroux/DFRLab)

In April 2021, a coordinated campaign targeting two South African banks surfaced on Twitter. While superficially taking aim at systemic racism in South Africa’s banking sector, beneath the #RacistBanksMustFall hashtag’s altruistic veneer were the vested interests of Sekunjalo Independent Media, owners of South Africa’s third largest news organization.

Key amplifiers of this hashtag, and several related ones, were journalists and organizations with links to Sekunjalo. The network used a combination of paid influencers and sockpuppet accounts to amplify #RacistBanksMustFall and #HandsOffAYO throughout April 2021, although evidence of earlier campaigns dating back to August 2020 could be found. This was shortly after one of the banks informed Sekunjalo it intended to sever their business ties.

The co-opting of racialized narratives is a common tactic in the South Africa information ecosystem. In 2016, this was exploited as part of a brief on behalf of the politically-connected Gupta brothers by the now-defunct PR firm Bell Pottinger ; Bell Pottinger set up “white monopoly capital” as a racialized scapegoat to distract from various controversies surrounding the family. More recently in July 2020, the DFRLab identified a government official using similar tactics to amplify traffic to his website.

South Africa’s massively inequal society is still haunted by the specter of Apartheid. Nearly three decades after the end of Apartheid, income disparities mostly coalesce along racial lines, which makes racialized narratives particularly effective as a backdrop for disinformation operations.

Dependent media

At the heart of this narrative sits the Sekunjalo group, a holding company for Iqbal Surve, a South African businessman. The Sekunjalo group is also the owner of Independent Media, publishers of an array of print and online news platforms, which has several of its journalists on the payroll of sister company AYO Technology Solutions Limited.

Sekunjalo and companies linked to it are mired in legal processes by the South African government’s Public Investment Corporation in an attempt to claw back R4.3 billion (approximately $300 million USD) of public worker’s pensions invested in the company. Surve has appeared before parliamentary inquiries regarding this “investment.” As a part of these efforts, AYO executives and Surve himself appeared before a Commission of Inquiry in 2019.

As media coverage of this Commission of Inquiry increased, a cluster of fake accounts began targeting journalists reporting on the proceedings with obviously pro-AYO narratives. More recently, Independent Media published an investigation using “cutting edge AI” to claim it was the target of a sophisticated social media campaign.


In April 2021, the hashtag #RacistBankMustFall gained significant traction on at least four occasions. One of these periods also coincided with #HandsOffAyo, a hashtag supporting AYO Technologies. These hashtags were prompted after it surfaced that two commercial banks, ABSA (Amalgamated Banks of South Africa) and First National Bank (FNB), intended to sever their business relationships with Sekunjalo’s companies. ABSA informed Sekunjalo of its intentions in August 2020, and FNB followed suit more recently on April 15, 2021.

Shortly thereafter, mentions of both #RacistBanksMustFall and #HandsOffAYO saw a proportional spike on Twitter.

A timeline generated via a Meltwater Explore query showing Twitter mentions of #RacistBanksMustFall and #HandsOffAYO during April 2021. Usage of #handsoffayo and #racistbanksmustfall coincided after FNB announced its plans to close AYO’s accounts on April 15, 2021. (Source: @jean_leroux/DFRLab via Meltwater Explore)

What sets this campaign apart from legitimate concerns around the transformation of the banking sector is the specific banks being targeted. Of the Big Four Banks in South Africa — ABSA, FNB, Nedbank, and Standard Bank — only ABSA and FNB drew the ire of this network. Incidentally, these were also the only two banks that severed their ties with Sekunjalo’s companies.

Ode to Iqarus

A network graph comprising of tweets containing #racistbanksmustfall over this period revealed that the bulk of the conversation centered around journalists linked to Independent Media, and a cluster of influencers and digital marketers who aggressively amplified the hashtag alongside them.

As is also frequently seen, a small group of user accounts used the popularity of the hashtag to market goods and services.

A social network graph consisting of tweets containing #RacistBanksMustFall between April 1, 2021, and April 30, 2021. A cluster of influencers and digital marketing accounts (green) amplified tweets by Independent Media journalists and activists. An oft-seen cluster of advertisers (purple) used the popularity of the hashtag for marketing. (Source: @jean_leroux/DFRLab via Gephi)

The coordination becomes even clearer when one filters the network graph to identify accounts with high amounts of interconnectedness, i.e., accounts that engaged with multiple other accounts in the same network. Filtering by this measure, known as the “k-core” value, more clearly shows the interconnectedness of these accounts. Using this filter, a cluster of 36 accounts were found to engage with at least 25 other accounts using the #RacistBanksMustFall hashtag over this period.

The same social network analysis graph, now filtered to show outgoing volumes of accounts with high interconnectedness. This showed the influencer/digital marketer communities engaged with each other and a cluster of “amplifier” accounts situated closely to Independent Media. (Source: @jean_leroux/DFRLab via Gephi)

A key amplifier in these communities is @mmodiba10, co-founder of an alternative media platform and a journalist affiliated with Independent Media. Several of the most engaged-with tweets during this period originated from his account.

Despite not being officially employed by Independent Media, both Modiba and his Insight Factor co-founder Thabo Makwawa frequently feature on the front pages of various newspapers within the Independent Media stable.

Screengrabs from several publications within the Independent Media stable featuring headlines by Modiba or Makwakwa. (Source, clockwise from bottom left: Facebook/archive; Facebook/archive; Facebook/archive; Facebook/archive; Facebook/archive)

In addition to these accounts, there is also clear coordination among a small number of accounts with high followings, all of which appear to be paid influencers or digital marketers, as evident from the accounts’ bio entries or from their timelines.

Screengrabs from one of the accounts indicating their role as social media promoter. A promotion for the TV show Temptation Island was approved on March 13, 2021 (left) and activated on March 31, 2021 (center). The engagement with users included retweets and replies using the #TemptationIsland hashtag. (Source: @ndi_muvenda_/archive, left; @ndi_muvenda_/archive, center; @ndi_muvenda_/archive, top right; @ndi_muvenda_/archive, center right; @ndi_muvenda_/archive, bottom right)
Screengrabs from the profiles of several of the accounts in the influencer/marketer cluster showing contact details or the presence of “promoter” or “digital marketer” in their bio entries. (Source, left to right, top to bottom: @ori_debig_beats/archive; @_shaunkeyz/archive; @GomolemoSA_/archive; @Kgaliiey_16/archive; @danielmarven/archive; @kambi_mohlala/archive)

Déjà vu

A number of the same influencer accounts seen so prominently in the network graph for #RacistBanksMustFall were also engaged with the #HandsOffAYO hashtag referred to earlier. This hashtag mainly saw use on April 16, 2021, a day after news broke that FNB would sever ties with Sekunjalo. These hashtags were used both in isolation and in tandem with #RacistBanksMustFall.

Screengrabs from searches performed on a selection of accounts in the RacistBanksMustFall influencer cluster showing earlier tweets spamming the #HandsOffAYO hashtag on April 16, 2021. (Source: @umalambane_zn/archive, left; @emma_tsebe/archive, center; @cellular_jnr/archive, right)

An additional link between these hashtags and the Independent Media is the extended coverage provided by its publications on these closures. Twitter accounts for Weekend Argus, The Star, Sunday Tribune, and Sunday Independent — all part of the Independent Media stable of publications — published links to the story on Independent Media’s main platform alongside the #HandsOffAYO and #RacistBanks hashtags.

Screengrabs from Twitter search results showing Independent Media publications amplifying the hashtags using their social media accounts and an article covering the topic. (Source, left to right, top to bottom: @DailyNewsSA/archive; @PostKZN/archive; @WeekendArgus/archive; @TheStar_news/archive; @PretoriaNews/archive; @SaturdayStar/archive; @PretoriaNews/archive; @SundayIndy/archive)

Sockpuppets and NGOs

There is also evidence that suggests sockpuppet accounts were used to amplify content supporting Independent Media and Surve, albeit to a lesser extent.

A highly active account within the dataset was that of @Thabo56024390, an account that almost exclusively engages with Independent Media content. During April, the account used the #racistbanksmustfall hashtag a total of 77 times and engaged with many of the other influencers using the hashtag. The account also used its associated Facebook page to share pro-Sekunjalo and pro-Surve links to various groups as far back as August 2019.

Screengrabs from the Twitter and Facebook account of “Thabo Molefe,” showing some of the pro-Sekunjalo messages (green) the account has been posting to various Facebook groups. (Source: @ThaboMo56024390/archive, bottom insert; Thabo Molefe Profile/archive, left; Facebook Graph Search — Racistbanksmustfall, center; Facebook Graph Search — Sekunjalo, right)

But the account is not what it appears to be. The profile picture used on both the Facebook and Twitter accounts for “Thabo Molefe” belong to a U.S.-based podiatrist and social media influencer, Dr. Ron Williamson. The image in questions was featured in a men’s catalog as far back as 2014.

Screengrabs of the Thabo Molefe profile picture (left) alongside reference images for Dr. Ron Williamson, whose images were used by the Thabo Molefe account. (Source: Thabo Molefe Facebook/archive, left; Black Mens Dossier/archive, center; @thedrron Instagram, top right; DrRondrickWilliamson Facebook Page/archive, bottom right)

The “Thabo Molefe” account was only the most active out of a number of these sockpuppet accounts, and several others amplifying the #RacistBanksMustFall hashtag were equally suspect. These include recent, seemingly batch-created accounts that were amplifying posts using these hashtags, “duplicated” accounts, and accounts that recently resurfaced after long periods of inactivity.

Screengrabs from the Twitter profiles of a selection of apparently batch-created accounts that exclusively engaged with the #RacistBanksMustFall hashtag. These accounts were created within the span of a couple of hours on 28 and 29 April 2021. (Source, clockwise from bottom left: @Khanya33554722/archive; @Kent05624903/archive; @Cathlee44416917/archive; @Thamsan01839043/archive; @Banele47155234/archive)
Screengrabs of the timelines of two accounts showing both showing signs of being repurposed, alongside a Twitonomy analysis of their accounts. @lednlite (left) engaged in various promotional hashtags, including Samsung and ABSA, before switching to RacistBanksMustFall. @Caramelfather (right) had not tweeted since August 2020 before resurfacing to begin tweeting the hashtag. (Source: @lednlit/archive, left; @Caramelfather/archive, right; @jean_leroux/DFRLab via Twitonomy, center)

A social media campaign amplified by journalists with links to Independent Media, clusters of sockpuppets, and a network of paid social media influencers targeted two South African banks. On the surface, this was framed as a call for transformation in the broader banking sector, when in reality the campaign targeted the two banks that severed ties with the embattled Sekunjalo group.

For not the first time in South Africa, the language of racial inequality and transformation was appropriated to further a commercially motivated agenda instead of the altruistic activism the hashtags implied.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Cite this case study:

Jean Le Roux, “Paid influencers and sockpuppets drove social media campaign targeting South African banks,” Digital Forensic Research Lab (DFRLab), July 1, 2021,