Delegitimizing Dissent: A Digital Forensic Analysis of the #MariaSarungiNiMamluki Campaign 

On June 8th – 10th, 2026, a Swahili-language hashtag campaign #MariaSarungiNiMamluki (“Maria Sarungi is a mercenary/puppet”)  circulated across X, accusing Tanzanian activist Maria Sarungi Tsehai of being a paid foreign agent (“wakala wa mabeberu”) who fabricated narratives about state violence to attract donor money and manipulate Tanzanian youth into the October 29, 2025 unrest.

Over the two days, the campaign hashtag generated 12.3k mentions and reached a total audience of 178 million, indicating patterns consistent with coordinated influence operations.

Screengrabs of #MariaSarungiNiMamluki campaign on X ( Twitter).

Who Is Maria Sarungi?

Maria Sarungi Tsehai is a Tanzanian media professional with 1.3Million followers on X (formerly Twitter). She is the founder of the #ChangeTanzania civic movement, owner of Compass Communications, and director of the independent outlet Kwanza Online TV / Mwanzo TV. She holds a degree from Eötvös Loránd University in Hungary, founded Compass Communications in 2000, and previously directed Miss Universe Tanzania. Sarungi also founded “Shangazi Power,” a movement focused on women’s political empowerment, and the NGO Inclusive Development for Citizens Tanzania (IDC-TZ) to institutionalize her advocacy work. 

She relocated to Nairobi in 2020 after the Magufuli-era closure of Kwanza TV. On January 12, 2025, Maria was physically abducted in Kilimani, Nairobi, by four armed men who choked her, blindfolded her, and demanded her phone passcodes, an incident condemned by Amnesty and Committee to Protect Journalists (CPJ). Al Jazeera reported she received screenshots from a Tanzanian CCM-linked WhatsApp group celebrating the abduction.

Piga Firimbi analyzed 7,790 posts and accounts on X, driving the  #MariaSarungiNiMamluki disinformation campaign, and discovered a targeted effort to discredit her.  This campaign misrepresents the nature of civil society work, echoing a state-sponsored narrative aimed at deflecting from domestic political grievances. It leverages the “foreign agent” trope, a common tactic used by authoritarian regimes to suppress dissent.  The bubble chart below shows the narrative themes of the campaign.

Flourish Link of bubble chart

 

Bubble chart on narrative themes in the campaign

Tanzania’s Post-Election Crisis

The #MariaSarungiNiMamluki campaign cannot be understood outside the context of Tanzania’s severe political and human rights crisis in late 2025. Tanzania’s general election held on October 29, 2025, was preceded by a systematic narrowing of the political space, including the arrest and disqualification of key opposition candidates, most notably Tundu Lissu of the CHADEMA party and ACT-Wazalendo’s Luhaga Mpina.

In an interview with Piga Firimbi, Advocate Jebra Kambole, the founder and partner of Law Guards Advocates in Dar-es-salaam, echoed election credibility and irregularities,“ There was no election in Tanzania, in many areas, voting effectively did not occur due to widespread violence and the absence of the largest opposition party, Chadema, which had been barred from participation by the judiciary.” He added that international observers were arrested or searched, the internet was shut down, and many polling stations were empty, leading to reports that National Election Commission officials were ordered to fill in ballots themselves.

On November 1, 2025, the incumbent, President Samia Suluhu Hassan, was declared the winner of elections gaining 97.6% of the votes widespread protests erupted, particularly in Dar es Salaam, Arusha, Mbeya and Mwanza. CNN’s Larry Madowo revealed Tanzanian security forces, including the military, were deployed to suppress demonstrations, using what human rights organizations termed excessive and lethal force. The government imposed a nationwide internet blackout from October 29 to November 3, 2025, and a 6 p.m. curfew.

While Tanzania’s commission of inquiry reported 518 deaths in April 2026, opposition parties and independent rights groups have cited figures ranging from 1,000 to over 3,000, alleging that authorities concealed the true scale of the violence by removing bodies and creating mass graves. Reports from Amnesty International, Human Rights Watch, and the United Nations documented the use of live ammunition against protesters and bystanders, and obstruction of medical care leading to a significant loss of life. Over 240 people were arrested and charged with treason, a non-bailable, potentially capital offense.

Advocate Jebra Kambole outlined the severe challenges facing activists and opposition voices in Tanzania, citing enforced disappearances and extrajudicial killings of human rights defenders, alongside the passage of restrictive laws, as Tanzania’s primary threats. He pointed to specific victims who all three remain missing  including, “CHADEMA youth leader Deusdedith Soka, CHADEMA youth activist Jacob Mlay, and Frank Mbise who were abducted together on 18th August 2024 in the Buza area, Dar es Salaam.” 

The advocate went on to highlight more freedom of speech concerns, “Ali Mohammed Kibao (Ali Kibo), a senior CHADEMA strategist was abducted from a bus in Dar es Salaam on 6–7 September 2024 and later the body of the 69- year old was found near the Indian Ocean coast with signs of physical tampering and torture,” as well as Shadrack Chaula (Shadracha), a portrait artist who has been reported missing and remains listed among the disappeared by Amnesty International and other human rights monitors.

 

Source	Estimate	Date Reported
UN OHCHR (initial)	At least 10	Late October 2025
UN (updated)	“Hundreds”	November 11, 2025
Human Rights Watch	At least 31 documented bystander killings; hundreds nationwide	Post-Nov 2025
Chadema / rights groups	1,000–3,000+	Late 2025
Tanzanian Presidential Commission	518 (96.7% civilian; 197 gunshot; 21 children)	April 23, 2026
Freedom House	At least 1,000	Freedom in the World 2026

Death-Toll Estimates from Various Sources

On November 14th, while addressing parliament, President Suluhu and other state officials framed the protests not as genuine expressions of dissent but as a “planned, coordinated, and financed” operation by “paid” youth and foreign actors seeking to destabilize the nation. This “foreign agent” narrative became the state’s primary tool for justifying its actions. It was within this environment of digital suppression and state-sponsored counter-narratives that Maria Sarungi became a prominent target.

In December 2025, Meta restricted Maria’s Instagram account within Tanzania, acknowledging it was acting on a legal order from the Tanzania Communications Regulatory Authority (TCRA). This act of censorship coincided with her efforts to document human rights abuses, amplifying the claims made by the #MariaSarungiNiMamluki campaign. Maria Sarungi Tsehai, a Tanzanian activist living in Kenya, responded to President Suluhu’s remarks by calling on her to step down.

The core of the campaign is encapsulated by the word “Mamluki” (mercenary), which implies Sarungi’s activism is a service for sale to the highest foreign bidder. This claim implies the mere presence of foreign funding nullifies the moral and political legitimacy of a civil society organization. The Tanzanian government’s frame that protests were “paid agitators” funded by Western NGOs is contradicted by the Tanzanian Commission of Inquiry itself, which attributed unrest to electoral disputes, socio-economic pressures, accountability failures, and weak service delivery, not foreign actors. Human Rights Watch specifically criticized the government for “focusing on the alleged financing and coordination of the protests rather than addressing the excessive use of force.”

On the legal front, Kambole identified loopholes and political bias in the Office of the Director of Public Prosecutions (ODPP), currently led by Sylvester Mwakitalu, as a tool exploited by the government for political gain. “Because the ODPP is appointed by and removable by the President, the office lacks independence and is used to target opposition figures with fabricated charges, such as terrorism, which have been applied to over 60 individuals,” he said, arguing that without reforms to ensure competitive and credible appointments, the office will continue to facilitate the persecution of dissenters.

NARRATIVE THEMES

Narrative Theme 1: “Activists Abroad Living Comfortably”

The narrative of “Activists Abroad Living Comfortably” appears in over 880 posts (11.1% of all posts) across 153 unique accounts, making it one of the most prominent lines of attack used to undermine opposition voices and discourage public participation. Sub-themes: “Safe abroad while youth suffer” (585 posts), “Named individuals abroad” (164), “Protected families” (132) Top pushers: @rahma_simba (43), @godfxer_fan (36), @mwamba_hi (36), @1ngadu1 (34), @bizydan (33)

    

The campaign constructs a specific contrast. This narrative frames prominent Tanzanian activists such as Maria Sarungi and Mange Kimambi as privileged “diaspora elites” who allegedly incite protests from the safety of foreign countries while young Tanzanians face violence and arrests on the streets.

Message	Kiswahili (Original)	English (Translation)
Message 1	“Wanaharakati wakuu ambao wanasemwa kuwa waliochochea ghasia za Oktoba ishirini na tisa wengi wao waliishi salama nje ya Tanzania. Mange Kimambi alikuwa Amerika huku Maria Sarungi akiwa Kenya…”	“Key activists alleged to have incited the October 29th riots mostly lived safely outside Tanzania. Mange Kimambi was in America while Maria Sarungi was in Kenya, directing opposition through phones and digital networks remotely.”
Message 2	“Tofauti kati ya wanaharakati waliokuwa salama nje ya nchi na vijana waliokuwa wakipigana mitaani inazidi kuleta maswali magumu.”	“The contrast between activists who were safe outside the country and youth who were fighting in the streets continues to raise difficult questions.”

By contrasting the activists’ perceived comfort abroad with the risks borne by local youth, the messaging constructs a “hypocritical elite” archetype that redirects public anger away from state actions and toward the organizers themselves. The technique exploits real economic frustrations, youth unemployment, and existing suspicions of the diaspora to portray remote advocacy as cowardice and exploitation rather than a response to restricted civic space and documented risks of persecution at home. In doing so, it inverts accountability, erases the reasons many activists operate from exile, and personalizes structural political grievances into attacks on specific individuals.

Narrative Theme 2: Youth Exploitation / Manipulation

The “Youth Exploitation / Manipulation” narrative appears in 1,793 posts (22.6% of all posts) pushed by 177 unique accounts. The narrative sub-themes were: “Youth unknowing victims” (554), “Youth as pawns/tools” (235), “Youth serving foreign agendas” (147), “Emotional manipulation of youth” (146) Top pushers: @bosongo_ (98), @isabela_ke (96), @wanjirujenty (87), @_zack255 (84), @rahma_simba (63) 

    

The single most duplicated message in the entire campaign (109 copies by 22 accounts):

Message 1	“Vijana wengi waliojiunga na maandamano hawakujua kwamba nyuma ya harakati hizo kulikuwa na maslahi ya kisiasa na kifedha ambayo hayakuwahusu. Wengi walitumika kama zana huku wakifikiri wanapigana kwa ajili ya haki na uhuru wa kweli wa wananchi wenzao.”	“Many youth who joined the demonstrations didn’t know that behind those activities were political and financial interests that didn’t concern them. Many were used as tools while thinking they were fighting for the genuine rights and freedom of their fellow citizens.”
Message 2	“Kauli inayojirudia miongoni mwa wananchi walioathiriwa ni kwamba vijana wa Tanzania walitumikia agenda za watu waliokuwa mbali nao.”	“A recurring sentiment among affected citizens is that Tanzanian youth served the agendas of people who were far from them.”

This narrative, one of the most heavily amplified in the campaign, claims that Tanzanian youth who participated in the October 29 protests were unknowingly manipulated and used as “tools” by activists pursuing hidden political and financial interests. The messaging repeatedly portrays young demonstrators as naive victims who were exploited by organizers operating from abroad, rather than as individuals exercising legitimate political agency. By framing the harm suffered by youth as the result of activist manipulation instead of state violence, the narrative effectively removes responsibility from security forces and redirects blame onto opposition figures. It further exploits parental concerns and societal fears by suggesting that activists deliberately put young people in danger for their own agendas. This technique not only strips youth of political autonomy but also mirrors a well-documented authoritarian tactic used in multiple countries to delegitimize protest movements by labeling them as foreign-orchestrated manipulation.

Narrative Theme 3: Foreign Funding Conspiracy

The Foreign Funding Conspiracy narrative had 1,015 posts (12.8%) pushed by 217 unique accounts. Sub-themes: “General foreign funding allegations” (1,429 across primary and secondary), “Mwanzo.Org funding” (345), “Ford Foundation” (29), “Financial evidence claims” (3) Top pushers: @bosongo_ (68), @wanjirujenty (63), @isabela_ke (53), @_jessy99 (40

 

#	Kiswahili (Swahili)	English Translation
1	Nakala iliyowasilishwa katika uchunguzi na ukweli ya mambo yaliyotokea Oct 29th ina onyesha kwamba shirika la Maria Sarungi, Mwanzo dot Org, lilipokea fedha kutoka kwa taasisi za kimataifa ikiwemo Ford Foundation.	Documents presented in the investigation of Oct 29th events show that Maria Sarungi’s organization, Mwanzo.Org, received funding from international institutions including the Ford Foundation.
2	Filamu hiyo inasisitiza kuwa uwazi unajenga uaminifu, wakati usiri kuhusu ufadhili na malengo unaleta shaka miongoni mwa wananchi.	The film argues that transparency builds trust, while secrecy about funding and objectives creates suspicion among citizens.
3	Filamu ilibainisha kwamba wananchi wengi wa kawaida hawakujua chochote kuhusu vyanzo vya fedha nyuma ya harakati hizo.	The film showed that many ordinary citizens knew nothing about the sources of funding behind those activities.

 

This narrative claims that Maria Sarungi’s organization, Mwanzo.Org, received funding from international institutions including the Ford Foundation, presenting these grants as evidence of a foreign-backed conspiracy to destabilize Tanzania. The messaging uses references to “investigations,” “documents,” and financial records to create an impression of factual inquiry, while portraying standard philanthropic support for civil society as secretive and suspicious. By repeatedly highlighting that ordinary citizens were unaware of these funding sources, the campaign frames legitimate NGO financing as proof of hidden external agendas rather than transparent and globally common practice. In reality, international foundation grants to civil society organizations are standard, publicly documented, and do not constitute foreign interference.

Narrative Theme 4: The Russia-Tanzania: A Curious Inclusion

The narrative themes “Tanzania-Russia Trade Soars by 293% in Five Years” “Russian Investment in Tanzania Creates Over 3,000 Jobs” “Bagamoyo Continues to Boom with Industrial Investment” stand out as a notable deviation, accounting for 780 posts.

The inclusion of positive Russia-Tanzania economic content appears thematically inconsistent with a campaign focused on exposing “foreign-funded activists,” suggesting a deliberate strategy to blend regime-friendly messaging with attacks on critics. This pattern is consistent with state-aligned information operations that use economic boosterism to build goodwill toward certain foreign partners while simultaneously discrediting domestic opposition voices.

Coordination VS Discourse

The #MariaSarungiNiMamluki campaign is designed to counter her movements associated with by advancing three primary, interconnected claims. The narrative unfolds through three closely interwoven storylines. First, the campaign portrays Sarungi’s movement as not grassroots, but driven by foreign capital and partisan political agendas. Second, it reframes post-election unrest, depicting public protests not as a spontaneous outburst of democratic public frustration, but as a calculated operation orchestrated in advance by movement organizers. Finally, the campaign connects these two ideas to challenge the ultimate legitimacy of Sarungi’s organizations, asserting that any institution relying on foreign funding is inherently compromised and disconnected from the national interest.

To make this story persuasive, the campaign relies on tight coordination across digital platforms, as shown in the graphs below of narrative themes over concentrated two-hour bursts.

The narrative co-occurrence matrix below illustrates how frequently distinct themes appeared together within a single post. The “Foreign Funding Conspiracy” theme dominates the dataset, appearing in 1,806 posts. The “Democracy as a Facade” theme co-occurred alongside it in 641 posts, establishing a direct mental link between foreign backing and fraudulent political institutions.

The accompanying heat map below shows the top 15 accounts driving these narrative themes, with cell values indicating post frequency per account, and deeper red shading highlighting high-density posting behavior. Account @isabella_ke emerged as a primary amplifier, generating 96 posts alone across these core themes.

By deploying coordinated, high-volume posts across targeted accounts, the campaign reinforces a core moral takeaway: while transparency builds public trust, covert foreign funding and undisclosed motives are inherently designed to breed public suspicion.

Evidence of Coordinated Inauthentic Behavior
1.  Temporal Patterns

Piga Firimbi analyzed 10,000 posts related to the hashtag #MariaSarungiNiMamluki on X (Twitter), spanning June 8–10, 2026. The analysis reveals strong indicators of coordinated inauthentic behavior (CIB).  The extreme top-heaviness of the top 10 accounts producing 36.1% of all content, as shown below, and the top 20 producing 50.2%, is a classic structural indicator of coordinated inauthentic behavior. Organic discourse on a political topic would typically see this concentration below 10%.

Original posts vs. retweet breakdown per account.

2. The June 8 Concentration

   Of the 10,000 posts analyzed, the overwhelming majority, estimated at 96%, were concentrated on June 8, 2026. Activity on June 9 dropped to approximately 181 posts, and June 10 saw only 4 posts. This single-day cliff pattern is inconsistent with genuine public interest, which builds over multiple days and declines gradually as attention naturally disperses. Instead, the sharp spike and equally sharp drop-off is characteristic of a planned, time-limited, resourced operation that was activated and then terminated.

Hourly activity distribution on June 8, 2026.

The peak activity occurs between 6:00–10:00 AM, with a secondary peak around 15:00 PM – 200:00 PM UTC. The dual-peak structure, combined with sustained high activity over approximately 14 hours, suggests an organized operational schedule rather than spontaneous social media engagement.

3. Automation Indicators

The most direct evidence of bot or automated-tool activity in the #MariaSarungiNiMamluki campaign comes from the analysis of posting intervals, the time elapsed between consecutive posts from the same account. Human beings require measurable time to compose, read, and publish social media posts. When an account posts multiple times per second, or when the median interval across hundreds of posts is zero seconds, the only technically plausible explanation is automation.

A. What “0-Second Median Interval” Means

A median posting interval of 0 seconds means that at least half of all posts from that account were timestamped within the same second as the immediately preceding post. Across the top five accounts in this dataset, this was true of between 112 and 204 individual post pairs. No manual posting behavior even using pre-composed templates on a mobile device  can replicate same-second posting at scale. This is a diagnostic signature of automated API access or bot software. Notably, all five top accounts have identical automation signatures as shown below. The fact that independent accounts exhibit this behavior simultaneously suggests not just individual bot use, but a coordinated botnet or a shared automation platform distributing tasks across multiple accounts from a central operator.

Posting interval analysis for the top accounts in the dataset.

Account	Total Posts	Median Interval	Posts <60s Apart	Posts <30s Apart
@bosongo_	250	0s	198	198
@_zack255	246	0s	179	179
@wanjirujenty	243	0s	204	204
@isabela_ke	234	0s	192	192
@rahma_simba	162	0s	112	112

Top Accounts: Posting Interval Analysis

The extreme concentration of 0-second intervals across all five high-volume accounts as shown below is a definitive automation indicator. Organic posting behavior would produce a normal distribution centered around several minutes, not a spike at zero.

1. The Activity Bursts

The highest- activity 5 minute windows showing concentration and coordinated posting :

Time Window (UTC)	Posts	Unique Accounts	Posts-per-Account Ratio
09:55:00	179	46	3.9
18:05:00	162	6	27.0
09:50:00	157	38	4.1
15:25:00	153	16	9.6
15:55:00	140	18	7.8
18:15:00	139	2	69.5
16:50:00	135	10	13.5
17:55:00	134	7	19.1
17:50:00	121	9	13.4
15:05:00	119	15	7.9

Table 5 Peak 5-Minute Activity Windows (All on June 8, 2026)

Notable anomaly: the 18:15 UTC window recorded 139 posts from only 2 accounts, a posts-per-account ratio of 69.5. This is a technically impossible rate for human manual posting and confirms automated mass posting.

4. Content Duplication
Scale of Duplication 

529 unique texts appeared more than once across the dataset. Of these, 480 unique texts were posted by different accounts distinguishing coordinated copy-pasting from an individual user’s own repeated posting. The single most duplicated text appeared 206 times across 21 separate accounts, making it functionally a coordinated broadcast rather than a spontaneous expression of opinion.

206 times • 21 accounts: “RT @_zack255: Vijana wengi waliojiunga na maandamano hawakujua kwamba nyuma ya harakati hizo kulikuwa na maslahi ya kisiasa na kifedha ambay …” [Young people who joined the demonstrations did not know that behind those movements were political and financial interests that did not concern them…]

96 times • 22 accounts: “Vijana wengi waliojiunga na maandamano hawakujua kwamba nyuma ya harakati hizo kulikuwa na maslahi ya kisiasa na kifedha ambayo hayakuwahusu …”

86 times • 15 accounts: “RT @_zack255: Uchunguzi unaonyesha kwamba harakati zilizoonekana hadharani kama mapambano ya demokrasia zilikuwa na tabaka nyingine za nia a …” [Investigation shows that movements that appeared publicly as struggles for democracy had other layers of intent that were not visible…]

32 times • 10 accounts: “MariaSarungiNiMamluki Wanaharakati Wanalipwa Mawakala Wa Mabeberu” [Activists Are Paid — Agents of Imperialists]

29 times • 16 accounts: “RT @Godfxer_fan: Wanaharakati wakuu ambao wanasemwa kuwa waliochochea ghasia za Oktoba ishirini na tisa wengi wao waliishi salama nje ya Tan …” [Leading activists said to have incited the October 29 violence mostly lived safely outside Tanzania…]

28 times • 18 accounts: “Nakala iliyowasilishwa katika uchunguzi na ukweli ya mambo yaliyotokea Oct 29th inaonyesha kwamba shirika la Maria Sarungi, Mwanzo dot Org, …” [A document submitted in the investigation and truth of what happened on Oct 29th shows that Maria Sarungi’s organization, Mwanzo dot Org…]

 

Table 3: Highly Repeated Narratives and Tweets

The table below shows top 15 accounts with narrative themes and a narrative flow of Sankei diagrams with source and mentions.

Narrative flow of sankei diagram with source and mentions 

The long tail of texts appearing across 10–22 different accounts demonstrates systematic message distribution rather than organic expression. The most-duplicated texts are not news articles or widely-shared media but original propaganda narratives attacking Maria Sarungi, indicating a centralized content creation and distribution operation.

Content duplication distribution.

5. Network Structure

• Synchronized Posting Pairs

A further confirmation of coordination is the analysis of account pairs that are posted at the same minute repeatedly. In an organic dataset, same-minute posting by two unrelated accounts would be rare. In this dataset, 15 pairs exhibit same-minute co-occurrences between 9 and 18 times, a statistically impossible rate under independence. Pairs such as @madikizela_win & @nairobeeee (18 co-occurrences) and @canabiscode & @msengeflanihivi (18 co-occurrences) demonstrate a level of posting coordination statistically inconsistent with independent organic behavior.

Most synchronized account pairs by same-minute co-occurrence count.

The dominance of retweet activity among high-volume accounts confirms the hub-and-spoke structure: the amplification layer accounts are almost exclusively retweeting hub content, with minimal original contribution, consistent with accounts operating on automated retweet scripts, as the Flourish retweet network graph below shows.

FLOURISH RETWEET NETWORK GRAPH

6. IDENTIFIED POTENTIALLY INAUTHENTIC ACCOUNTS

Based on the combined evidence (posting speed, volume, low authority, content duplication, synchronized behavior), the following accounts show the strongest CIB indicators:

Tier 2 : High Confidence ( Coordinated Amplifiers)

Account	Posts	Evidence
@1ngadu1	153	Key content source; amplified by coordinated network; 275 RTs received
@mwamba_hi	149	Systematic retweet patterns; 157 RTs received
@dictatorbin	132	Systematic amplification; high synchronization score
@mamawataifassh	124	Only 1,023 followers; authority 5; disproportionate activity
@bizydan	113	Systematic amplification pattern
@msengeflanihivi	110	Only 87 followers; authority 3; 18 same-minute co-occurrences with @canabiscode
@godfxer_fan	95	174 RTs received; high sync score with multiple accounts; 11 same-minute co-occurrences

 

Tier 2 Accounts

Several low-authority accounts exhibited unusually high posting activity despite having very small follower bases, a pattern that may indicate coordinated amplification rather than organic engagement. For example, @wanjirujenty published 126 posts while having only 57 followers and an authority score of 3. Similarly, @msengeflanihivi made 65 posts with just 87 followers (authority 3), @254_mannu28013 posted 46 times despite having only 16 followers (authority 1), and @thimlichh shared 42 posts with merely 14 followers (authority 2). Other accounts, including @canabiscode (21 posts, 21 followers, authority 2) and @sharubukidevuni (23 posts, 10 followers, authority 1), displayed the same pattern of high posting frequency relative to their limited audience.

Tier 3:  Suspected Sockpuppets (Low- Authority Amplifiers)

Account	Posts	Followers	Authority	Key Anomaly
@254_mannu28013	46	16	1	16 followers; authority 1; 46 posts is extreme over-performance
@thimlichh	42	14	2	14 followers — near-zero genuine audience
@sharubukidevuni	23	10	1	10 followers; authority 1; likely burner account
@canabiscode	21	21	2	21 followers; 18 same-minute sync events with @msengeflanihivi
@feleh_ke	39	24	2	24 followers; extremely high posts-to-followers ratio
@mariashamawxs1	20	38	2	Minimal audience; systematic amplification
@calpaul001	42	51	3	Very low authority relative to posting volume
@mtendajii	37	55	3	Consistent with dormant-then-activated sockpuppet pattern
@cyntty001	59	114	4	Moderate followers but anomalous activity intensity
@254_nicoo	50	141	4	High posting volume relative to authentic presence

 

A.  Hub-and-Spoke Amplification Model

Analysis of the retweet network reveals a clear hub-and-spoke architecture: a small cluster of accounts produces the original content (“hubs”), while a much larger population of accounts serves exclusively to retweet and amplify that content (“spokes”). This structure is engineered to create artificial virality and the appearance of widespread organic endorsement while the actual content originates from a controlled central source.

54.8% of all posts are retweets, indicating that this is fundamentally an amplification campaign rather than a discourse campaign. The most retweeted account is @_zack255 (294 RTs received), followed by @1ngadu1 (275 RTs), @Godfxer_fan (174 RTs), and @mwamba_hi (157 RTs).

The Sankey diagram below shows the flow of duplicated content between accounts
with source-to-target duplication amplification

 

7. HOW THESE NARRATIVES WORK TOGETHER: THE ARCHITECTURE OF A DISINFORMATION CAMPAIGN

A. THE NARRATIVE FUNNEL
The Narrative Funnel reinforces the campaign’s narrative architecture, with each theme supporting and amplifying the others ;

This layered structure above illustrates how the #MariaSarungiNiMamluki campaign systematically escalates its messaging from emotional appeal to ideological delegitimization. It begins by triggering sympathy and concern through the claim that youth were manipulated and harmed (Layer 1), then quickly identifies specific villains by naming activists such as Maria Sarungi and Mange Kimambi as the remote orchestrators (Layer 2). The narrative then supplies a motive by alleging that these activists were paid by foreign powers, particularly the Ford Foundation, to destabilize the country (Layer 3). This is reinforced through an ideological frame that labels the activists as “Mawakala wa Mabeberu” (agents of colonialists), tapping into anti-Western and nationalist sentiments (Layer 4). Once the foundation is laid, the campaign advances a broader counter-narrative that dismisses all activism and democratic language as a Western-funded facade and business venture (Layer 5). Finally, it offers a positive alternative by promoting pro-government and pro-Russia economic messaging, such as increased trade and job creation, to redirect public attention toward regime-friendly narratives (Layer 6). This sequential approach allows the campaign to move audiences from emotional reaction to full ideological rejection of opposition voices.

Psychological Buttons Being Pushed

This section of the campaign analysis reveals the narratives were carefully calibrated to exploit specific psychological vulnerabilities. The messaging primarily targets three key audiences: Tanzanian youth, by framing them as manipulated victims; middle-class parents, stoking fears that activists are endangering their children; and Pan-African or nationalist audiences, by portraying the protests as part of a Western-backed effort to destabilize the country.

These messages are designed to trigger class resentment, suspicion of foreign influence, fear of chaos, and nationalist pride, while aligning closely with the government’s official position that the October 29 protests were not a genuine popular uprising but a premeditated operation orchestrated by activists. Notably absent from the entire campaign are any references to state violence against protesters, the underlying grievances that sparked the demonstrations, mass arrests, restrictions on press freedom, or broader democratic concerns further indicating the coordinated effort to shield the state from accountability.

8: Regional Context: A Pattern, Not an Anomaly

Geographic analysis of the dataset reveals a distribution that is inconsistent with organic East African political discourse about a Tanzanian issue. The hashtag #MariaSarungiNiMamluki is explicitly about a Tanzanian issue,October 29, 2025, Tanzanian elections and a Tanzanian activist. Yet Kenya accounts for 52.4% of posts (2,066 posts), while Tanzania accounts for only 31.1% (1,228 posts). While Sarungi is based in Nairobi and has Kenyan followers, the 21.3 percentage-point gap between Kenyan and Tanzanian activity on a fundamentally Tanzanian political topic is anomalous. It suggests either that the campaign was operated primarily from Kenya-geolocated accounts, or that Kenyan accounts were activated as part of a cross-border coordination network. In Tanzania X is banned and people have to use VPN to bypass restrictions. 

 

France appears as the third-largest source of posts at 7.6% (298 posts) ahead of the United States (4.4%) and United Kingdom (1.2%). The most technically plausible explanation of VPN or proxy infrastructure to mask operational centers, and activating cross-border diaspora networks as part of the amplification architecture. These countries have negligible organic connection to East African political discourse.  

THE CAMPAIGN’S NARRATIVES : FACT-CHECKED

The hashtag #MariaSarungiNiMamluki travels with three recurring Swahili tags: “Wanaharakati Wanalipwa” (activists are paid), “Mawakala Wa Mabeberu” (agents of imperialists), and labels such as “kirusi” (virus). Each major narrative is assessed below:

Table 1: Campaign Claims vs. Verifiable Evidence

Campaign Claim	Verifiable Evidence	Verdict
Sarungi is a “mercenary/puppet” of foreign powers	Documented Tanzanian activist since early 2010s; #ChangeTanzania launched 2012; abducted in Nairobi 2025	FALSE
She receives covert foreign funding to destabilize Tanzania	Ford Foundation support since 2006 is publicly disclosed; supports civil society broadly, not covert ops	MISLEADING
Activists like her caused/manipulated the October 29 unrest	Unrest driven by candidate disqualifications and security force violence per HRW, Amnesty, UN, CNN, and Tanzania’s own Commission of Inquiry	FALSE
Her activism is “fake digital activism” disconnected from citizens	Long-running “Maria Spaces” on X; Kwanza/Mwanzo TV; documented public mobilization	MISLEADING
Meta restricted her because she violated content standards	Meta explicitly confirmed restriction was in response to a TCRA legal order, not a policy violation	FALSE

 

Table 1 Campaign Claims vs. Verifiable Evidence

Ultimately, the #MariaSarungiNiMamluki campaign is a calculated political attack. It functions as a tool of repression, perfectly aligned with the Tanzanian government’s narrative during the violent post-election crackdown of 2025. It serves to intimidate critics, sow public distrust in civil society, and provide a veneer of justification for the state’s suppression of dissent.

CLAIMS THAT CAN BE FACT-CHECKED

Claim	Checkable?	Notes
“Mwanzo.Org received Ford Foundation funding”	Yes	Ford Foundation grants are public. Can verify amount, purpose, and timing
“PAWA 254 received large funding before Mwangi’s in-volvement in Tanzania”	Yes	PAWA 254 is a registered Kenyan NGO with filings
“October 29 was pre-planned by foreign actors”	Partially	Can examine timeline of events, arrest records, and in-dependent reporting
“Tanzania-Russia trade grew 293%”	Yes	Can verify with Tanzania Bur-eau of Statistics and UN Comtrade data
“Russian investment created 3,000+ jobs”	Yes	Can verify with investment authority records
“Activists manipulated youth through social media”	Unfalsifiable	This is a characterization, not a factual claim
“Mabeberu” / “foreign agents”	Political label	This is rhetorical framing, not a verifiable claim

THE TACTIC OF DELEGITIMIZATION

Smears of activists as foreign agents are a regional template. CIPESA, Africa Center for Strategic Studies and the Atlantic Council document that disinformation campaigns in East Africa have surged nearly fourfold since 2022, with East Africa hosting the highest share of domestically originating campaigns on the continent.

The #MariaSarungiNiMamluki campaign is a textbook case of how authoritarian-leaning states and their proxies use disinformation to shrink civic space. The “foreign agent” narrative is a powerful tool of shifting the debate away from the state’s actions (e.g., election rigging, police brutality) and onto the identity and motives of the critics. Instead of debating the merits of a call for electoral reform, the public is encouraged to debate whether the person making the call is a patriot or a traitor. 

The campaign seeks to undermine public trust in civil society by portraying activists as “mercenaries” or agents of foreign interests. This framing is intended to weaken the relationship between civil society organizations and the communities they represent, reducing public confidence in their work and isolating activists from potential supporters.

The messaging may also contribute to a chilling effect on civic participation. By characterizing activists as foreign agents or threats to national security, such narratives can provide justification for heightened surveillance, arrests, harassment, censorship, or other forms of state action against critics. Even where these measures are not explicitly implemented, the perception of increased risk may discourage individuals from engaging in advocacy or expressing dissent.

Following President Hassan’s public remarks in May 2025 referring to some foreign activists as “foreign agents,” the operating environment for human rights defenders became increasingly challenging. Within this broader context, the campaign targeting Maria Sarungi can be understood as part of a wider strategy observed in Tanzania and elsewhere in East Africa, where prominent critics are portrayed as representatives of foreign interests.

Ultimately, the #MariaSarungiNiMamluki campaign appears to function as a coordinated political messaging effort aimed at discrediting a prominent government critic. The campaign aligns with broader narratives that portrayed dissent and civic activism as being driven by foreign interests during Tanzania’s post-election crackdown in 2025. By framing Maria Sarungi and other activists as foreign proxies, the campaign seeks to erode public trust in civil society, discourage criticism of the government, and reinforce narratives that can be used to legitimize restrictions on dissent and civic space.

THE GLOBAL PLAYBOOK : SMEAR CAMPAIGNS

Africa Uncensored War on Words examines how smear campaigns and disinformation are used to weaken the credibility of media actors in Kenya. The attacks against the outlet fit a broader pattern of delegitimization, a tactic also documented by Piga Firimbi in its Deflection Tactics investigation under the Fertile Deception project.

According to Africa Uncensored, dozens of accounts circulated the hashtag #AllanNamuCompromised between May 10 and 11, 2024. The campaign paired the hashtag with claims that executive producer John-Allan Namu and fact-checker Tracy Bonareri were biased, showing how coordinated online abuse can be used to discredit journalists and their work. The table below shows the individuals and organizations targeted, the number of posts associated with each, and their role in the narrative. 

Individual/Organization	Posts Mentioning	Role in Narrative
Maria Sarungi	521	Primary target — “foreign agent” running Mwanzo.Org
Boniface Mwangi / PAWA 254	225	Kenyan activist — “foreign in-terference” angle
Mange Kimambi	176	Diaspora activist in USA — “comfortable abroad” frame
Mwanzo.Org	164	Sarungi’s organization — “foreign-funded”
Ford Foundation	29	Named as funder — “proof” of foreign control

Amid the political backdrop of Kenya’s upcoming elections and the high-profile abduction and torture of presidential candidate Boniface Mwangi in Tanzania, human rights lawyer Jebra Kambole urged regional authorities to focus on systemic overhaul. “We need to amend laws and reform the judicial system, the police force, the National Election Commission, and the Commission for Human Rights and Good Governance,” Kambole stated. Emphasizing the need for structural reform and a people-centered constitution ahead of future election cycles, Kambole pointed out that while CCM has included constitutional reform in its platform, “It has done so without a clear timeline for implementation.”

On August 25, 2026, Vice-President Emmanuel Nchimbi formally notified President Samia Suluhu Hassan that he was stepping down from public service. The 54-year-old, who had served just 10 months in the post, later shared his brief resignation letter on Instagram, saying he had become convinced that the President wanted changes. His resignation followed weeks of increasingly pointed public remarks, including a call for Tanzanians to “fight for a new constitution”, prompting speculation about tensions within the country’s leadership.

Two days after resignation, the Chama Cha Mapinduzi (CCM) National Executive Committee unanimously expelled Nchimbi, accusing him of violating the party’s rules on discipline and ethics.

Nchimbi has not appeared publicly since announcing his departure, fuelling a wave of unverified claims on social media that he may be under house arrest or facing a more serious fate. Former Prime Minister Joseph Warioba said he spoke briefly with Nchimbi after the resignation but has since been unable to reach him despite repeated attempts.

In charting a course for reform, Jebra Kambole urged Tanzanians to keep pushing for institutional change, stand by frontline advocates, and speak up for those silenced by fear. He also called on international allies, especially in Kenya, to apply continuous pressure to demand governance accountability and transparency across the region.

BEYOND THE LANGUAGE

The Campaign Tagline: “Wanaharakati Wanalipwa Mawakala Wa Mabeberu”

This phrase appeared in 685 posts as an exact match and functioned as the campaign’s unifying tagline, appended to virtually every post regardless of specific narrative content. It appeared in 96.3% of all posts when including partial matches.

 

Swahili	English	Literal Meaning
Wanaharakati	Activists	People who engage in activ-ism/movements
Wanalipwa	Are paid / Are being paid	From “kulipwa” — to be paid
Mawakala	Agents / Operatives	From “wakala” — agent, proxy
Wa	Of	Possessive particle
Mabeberu	Colonialists / Imperialists / Westerners	Derogatory term for European/Western powers

 

Full translation: “Activists Are Paid Agents of the Colonialists”

The word “Mabeberu” carries the full weight of East African anti-colonial struggle: Derived from Swahili slang for specifically goats “beberu”), applied metaphorically to European colonial powers who were seen as predatory and domineering.

Word cloud on the #MariaSarungiNiMamluki campaign

In this campaign, the “wanalipwa” accusation appeared in 1,004 posts, representing 12.7% of the dataset, with specific references to the Ford Foundation being used to reinforce the claim against Maria Sarungi.

The claim functions as a highly effective propaganda tool because it is nearly impossible to disprove: any form of funding, whether from grants, donations, or operational support, can be reframed as evidence of external control. By associating legitimate international philanthropic funding, such as grants from the Ford Foundation to organizations like Mwanzo.Org, with betrayal and foreign servitude, the narrative creates guilt by association and preemptively discredits everything an activist says or does. Once labeled as “paid,” their motives, statements, and actions are automatically viewed with suspicion, regardless of the actual content or evidence they present.

METHODOLOGY

The dataset analysed for this investigation comprises of 10,000 posts scraped from X  using keyword and hashtag tracking #MariaSarungiNiMamluki. The two scrapes each containing 5,000 posts were taken approximately 39 seconds apart and share 2,081 overlapping documents (41.6% of each), yielding 7,919 unique posts. The data spans (June 8–10, 2026), and includes metadata on content type, author handle, posting time, hashtags, engagement metrics (likes, reposts, replies, views), geographic tags, and text content. 

Limitations should be noted: the dataset reflects a filtered collection, not a full platform capture. Account creation dates, follower counts, and verification status were unavailable, constraining the ability to identify newly created or bot-like accounts with certainty.

Follow Africa Uncensored’s WhatsApp Channel for verified facts and updates on what’s happening online.