A coordinated social media campaign involving accounts in several countries helped mobilise tens of thousands of people ahead of the mass attempt to enter Spain’s North African enclaves of Ceuta and Melilla, according to a Spanish intelligence report.
The campaign reportedly began in July 2026 and generated around 11 million views across accounts and pages believed to have been operated from several countries, including Algeria, Tunisia and France, Spanish newspapers El País and La Razón reported.
Spanish security and international terrorism analyst Chema Gil said online activity increased sharply after Spain’s Supreme Court publicly issued a ruling in early July concerning the treatment of migrants intercepted at sea.
Judicial ruling fuels online mobilisation
The intelligence assessment identified the Supreme Court ruling as a major turning point in the digital campaign.
The court ruled that migrants intercepted at sea could not be immediately or forcibly returned without the required legal procedures. According to the report, online accounts quickly began circulating the ruling as evidence that those reaching Spanish-controlled waters might avoid immediate deportation.
Researchers detected intensified activity by accounts operating from Morocco, Algeria, Tunisia, France and the United States. In the days leading up to the mass crossing attempt, they shared mobilisation messages, travel instructions, possible routes and logistical information.
The report’s authors used open-source intelligence, known as OSINT, and social media intelligence, or SOCMINT, to reconstruct the campaign’s timeline and trace the development of a network of accounts and messaging groups involved in spreading information and encouraging participation.
The monitoring period extended from June to early August 2026 and covered Facebook, TikTok, WhatsApp, Instagram and X.
The findings showed that activity began rising in early July and accelerated significantly after the Supreme Court ruling. Posts, videos and mobilisation messages continued to increase, reaching their highest level in the days before Morocco’s Throne Day celebrations.
A network with different roles
The report said the campaign did not appear to have been directed by a single organisation or central command structure. Instead, it operated as a distributed network in which different accounts and groups performed complementary roles.
Some accounts focused on producing and publishing videos and messages to maintain public interest, while others redistributed the material across multiple platforms, significantly expanding its reach.
Messaging groups played a more operational role, exchanging information about travel arrangements, transport schedules, meeting points and developments along the border.
Algerian-linked WhatsApp groups
Among the report’s most notable findings was the identification of WhatsApp groups administered through telephone numbers carrying Algeria’s +213 international dialling code.
The groups reportedly exchanged information about travel routes, transport options, timings and gathering points, as well as practical instructions for reaching areas near the border breakwater.
At the same time, highly active accounts on TikTok, Facebook and Instagram circulated audiovisual content intended to sustain mobilisation and broaden the audience for the campaign’s messages.
No clear central command
The report concluded that the digital activity preceding the attempted border rush was not, based on the available evidence, a centrally controlled operation led by a single identifiable actor.
Instead, it involved a decentralised network of accounts and groups, with some producing content, others amplifying it and private messaging channels distributing practical information.
According to the assessment, this decentralised structure made the campaign more resilient. The removal of individual accounts or posts was not enough to disrupt the wider mobilisation effort because the information continued circulating through numerous platforms, channels and groups.
