BANNER: Screenshots show three accounts posting similar, likely AI-generated visuals showing protestors with Kenyan and Russian flags. (Source: @florenceetuku1, left; @TalesofBosongo, center; @scooby_754, right)

In the summer of 2024, as Kenyans protested in the streets and on social media against a controversial proposed finance bill, a network of X accounts appeared to operate in coordination, amplifying several hashtags that attacked protestors and boosted support for President William Ruto and the government. The accounts flooded X with similar or identical posts, often shared within a short period of time, and used images that appeared to be AI-generated. More than fifty accounts that promoted at least one of the examined hashtags appeared to be part of an initiative from a marketing firm that hires content creators and influencers to promote various online campaigns.

The use of social media influencers and content creators to spread disinformation and control political narratives in Kenya was previously flagged by the African Digital Democracy Observatory as a “growing problem in Kenya.” Research by the Mozilla Foundation in 2021 examined disinformation-for-hire campaigns in which influencers were paid to attack civil society members and organizations in Kenya. A 2022 BBC report also noted that flooding social media with hashtags is a common strategy used in Kenya by hired influencers in political campaigns.

The DFRLab previously monitored and analyzed the hashtags that trended in Kenya after large-scale protests erupted in June 2023, including the prevalence of #RejectFinanceBill2024 and #Rutomustgo, which received millions of engagements and views. Soon after these hashtags began trending, other pro-government and anti-protest hashtags emerged. Additional analysis of the hashtags revealed a suspicious network of accounts that appeared to coordinate to artificially boost the hashtags.

The network of identified accounts focused on boosting engagement for the new hashtags, which promoted the finance bill, attacked protestors and other politicians, offered support to President Ruto, and called for the cessation of protests in favor of dialogue with the government. Using the social media monitoring tool Meltwater Explore, the DFRLab reviewed and analyzed more than a dozen hashtags promoted by the network before and after protests started.

The table shows several hashtags promoted by the pro-government network between June 19 and July 10, 2024, before and after the protests erupted. (Source: DFRLab via Meltwater Explore)

The hashtags followed a consistent pattern, quickly rising and fading in popularity. They usually maintained activity for only two days, peaking on day one and then plummeting in volume.

Before the protests escalated on June 25 and as criticism of the bill increased, some accounts in the network used the hashtag #LiesVsFacts to spread positive information about the bill. These accounts maintained that criticisms of the bill were based on misconceptions they claimed to be correcting.

After Ruto withdrew the bill after the protests erupted, demonstrations continued as protestors called for the president’s resignation using the hashtag #RutoMustGo. Accounts in the suspicious network responded by boosting the hashtag #RutoOurPresident. Other hashtags boosted by the network called for dialogue with the government instead of protesting, using hashtags such as #LetsDialogueNow and #DialogueHasWon.

The graph shows peak mentions of pro- and anti-government hashtags before and after protests escalated on June 25, 2024. The graph highlights that anti-government hashtags received far more engagement than pro-government hashtags. (Source: DFRLab via Meltwater Explore)

In one example, the account @kelitu__ used #LiesVsFacts on June 23 to counter protester claims and then employed #LetsDialogueNow on June 28 to call for engagement with the government instead of protests. Afterward, on July 5, @kelitu__ and other accounts promoted an X Space in which Ruto joined a live audio discussion with X users using the hashtag #GenZEngaging.

The network also promoted hashtags such as #GayZ and #GoonZ to attack the protestors by claiming that some were trying to push an LGBTQ+ agenda. Kenyan fact-checking organization Piga Firimbi reported on this campaign and how it served as a distraction.

The network also claimed that some of the protestors were funded by Russia, specifically the Wagner Group (which operates in several African countries), to “create the illusion of a spontaneous uprising” and to “sow discord.”

Kenyan politicians were also blamed for inciting the protests, with these narratives promoted via the hashtags #RiggyGStopFAKES, #truthlessman, #MigunaTheLiar, and #EnemiesOfTheState. Targets included former president Uhuru Kenyatta, Deputy President of Kenya Rigathi Gachagua, and opposition figure Miguna Miguna. The accounts claimed these figures were hijacking the protests for their own agenda.

Later, the accounts also engaged with hashtags used to express discontent, such as #Tumechoka, which means “We are tired” in Swahili, this is also a phrase used by the anti-tax bill protestors. Narratives shared using the hashtag emphasized the negative impact of the protests on tourism and Kenyan workers to call for the protests to stop.

In reviewing the network, the DFRLab uncovered many accounts that promoted at least one of the pro-government hashtags and were also involved in other political or commercial campaigns that used similar tactics, such as hashtag boosting.

For example, some accounts in the network, such as @Mickey254_, @emaboy28, @RemyGitonga, and @astronovar, previously promoted positive posts about Kenyan politician Moses Kuria. These accounts also promoted a hashtag advertising a supermarket chain in Kenya. 

At least 29 accounts involved in the other campaigns appear to have been hired by, working with, or using the marketing firm Twiva, an “influencer-driven social commerce platform” previously mentioned in a BBC report for possibly “using its platform to work with political campaigns” in Kenya.

In one of the campaigns, accounts promoted a flour brand that was available on Twiva’s website while using the hashtag #KuzaBizNaTwendeDigital. Another campaign used the same hashtag to promote an outdoor equipment store in Kenya. The first part of the hashtag, Kuza Biz Na, means, according to machine translation, “Grow Business” or “Grow Business With” in Swahili, while the second part, TwendeDigital, refers to a project by Twiva under the same name, in which social media influencers and content creators can sign up to be hired to promote small and medium businesses’ products using their profiles. The program is presented as a work opportunity for young content creators that also supports smaller businesses.

Notably, six accounts that posted both commercial and pro-government hashtags indicated in their bios that they might be using their accounts for advertising, including phrases such as “Dm for ads and promos” or “DM for advertisement.”

It appears that some of the accounts in this program were also used to attack Kenyan protestors and support President Ruto. It is important to note, however, that not all accounts that boosted the pro-government and anti-protest hashtags took part in the other commercial or political campaigns.

The DFRLab reached out to Twiva for comment prior to publishing but did not receive a response.

One of the primary suspicious indicators of the network is their use of similar and often identical text to amplify the hashtags. In one example, boosting #LetsDialogueNow, seven accounts posted the same thread with identical text within three minutes, calling for “constructive dialogue” with the government after the bill’s withdrawal instead of protests.  

In addition, accounts rapidly posted text and pro-government hashtags within a short amount of time. For example, On June 28, the hashtag #RutoOurPresident received over 2,500 engagements from more than 450 accounts between 3:10 PM and 7:42 PM local time. During this period, accounts engaged with the hashtag seconds and minutes apart. Many accounts, such as @TalesofBosongo, @SamKalyz, @Carribean3_, and @MissKemunto, often posted the hashtag and similarly designed visuals. This pattern was noted in other hashtags promoted by the network, suggesting that the network engaged in mass posting within a short timeline.

More than forty accounts in the network were created in June and July 2024, before and after the protests erupted. While confirming if these accounts were created specifically to aid the campaign is challenging, this may be the case given their focus on promoting hashtags that support the government and attack protestors. Some accounts, such as @Isaahoyee and @cecilcross24, both created in July 2024, had only shared one post at the time of writing, which used the hashtag #RevolutionStealers.

Many of these new accounts did not use images for avatars, but the ones that did used stock or publicly available images or used seemingly AI-generated images. Notably, two accounts in the network, @Mark_moto95 and @Deane920774, used publicly available AI-generated images of young African individuals, which were detectable using reverse image search.

It is likely that other new accounts also generated their own AI images instead of stealing AI-generated photos. For example, the accounts @MWosa_JY254 and @QuinterMor61389 both used very similar art-like photos with the same composition, showing three models in each photo, all wearing dresses.

One of the patterns noted in the network’s posts is their use of similar visuals. For example, one image format used stock or publicly available images in the middle with text above and below the image.

Accounts such as @SalibaEra_and @SamKalyz promoted #RutoOurPresident using a similar graphic that included a stock image of two males talking to each other and text saying, “LETS EMBRACE DIALOGUE.”

The accounts also often used seemingly AI-generated images showing protestors raising Kenyan and Russian flags to claim that Russia or other Kenyan politicians hired some of the protestors. The similarity of the images suggests that they were generated using similar prompts.

Other examples of possibly AI-generated images used were found in the hashtag #GayZ, showing different images of same-sex protestors kissing. For example, the accounts @Iam_SharMo and @limo_39 both posted what appear to be AI-generated images of same-sex Kenyan protestors kissing, falsely claiming that LGBTQ+ groups are taking advantage of the protests to push their agenda.

Many of the accounts promoted each other’s posts in what appears to be an effort to feign engagement to make the hashtags and content appear more popular than it was. For instance, as accounts promoted Ruto’s X Space discussion with Kenyans, which took place on July 5, using #GenZEngaging, accounts such as @astronovar replied to and quote retweeted posts promoting the hashtag with text saying that the account is looking forward to the conversation with the president. The account made three quote retweets, five retweets, and eleven replies to posts by other accounts in the network using this hashtag.

While X is not one of the top three social media platforms in Kenya in terms of usage, recent events have proven its importance to online users in the country, as Kenyans used the platform for mobilization and advocacy. This report also demonstrates the presence of possible coordinated campaigns on X that sought to disrupt online conversations and offline demonstrations in Kenya.

Editor’s note: Ali Chenrose is a pen name used by a DFRLab contributor for safety reasons.

Ali Chenrose, “AI tools used in Kenya to discredit protesters, suggest Russian connections,” Digital Forensic Research Lab (DFRLab), December 19, 2024, https://dfrlab.org/2024/12/19/ai-tools-used-in-kenya-to-discredit-protesters-suggest-russian-connections/.