On June 4, 2026, dozens of demonstrators gathered in Al Sarraj district of the Libyan capital, Tripoli, protesting what they described as the "settlement of migrants," raising banners and slogans such as: "No to settlement" and "Libya for Libyans."

The protests were not limited to demonstrations but extended to an attempt to storm the headquarters of the United Nations Support Mission in Libya (UNSMIL), before the United Nations High Commissioner for Refugees (UNHCR) temporarily closed its office in Tripoli, coinciding with security campaigns and raids targeting refugees and migrants in a number of streets in the capital, Tripoli.

How did hashtags circulating on social media platforms turn into protests that ended in this escalation?

This study examines the digital mobilization that preceded the protests by reviewing more than 1,800 social media posts. It aims to uncover the growth of hate speech and disinformation, the amplification of anti-refugee hashtags, and the connection between these online trends and the civil unrest in Tripoli.

The investigation relied on analyzing posts and hashtag data using digital monitoring tools, while examining the most active accounts, posting patterns, timings, and the nature of the circulated content, with the aim of tracking the campaign's development and monitoring indicators of coordination and the amplification of anti-refugee discourse. In doing that we did not solely rely on the number of posts, but took into account posting patterns, message repetition, the movement of hashtags between platforms, and the nature of the participating accounts.

The United Nations denies "settlement" allegations

Following the protests, the United Nations Support Mission in Libya condemned the acts of violence and the attempt to storm its headquarters, confirming that the incitement and disinformation circulating on social media platforms contributed to escalating tensions and threatening United Nations staff and premises.

The Mission, along with UN agencies operating in Libya, including the UNHCR, also denied the existence of any programs for the settlement of refugees or migrants within Libya, describing the allegations circulating in this regard as "completely baseless."

It confirmed that UNHCR's work is carried out in coordination with Libyan authorities and international partners, and is limited to protecting people fleeing wars and persecution, and working to find solutions outside Libyan territory, such as resettlement in third countries or supporting voluntary return to their countries of origin when conditions permit.

حقوق النشر AP Photo

Despite this official denial, allegations regarding the settlement of migrants continued to spread on social media platforms, and their use in calling for protests and inciting against refugees increased, which raises the question: How did this digital campaign begin? And how did it evolve during the weeks that preceded the June 4th protests?

From Egypt and Tunisia to Libya: The contagion of anti-refugee discourse

Monitoring showed that the campaign that preceded the Tripoli protests did not start within Libya, but rather came as an extension of similar waves of anti-refugee and migrant discourse witnessed in neighboring countries during the previous months.

In Egypt, the hashtag #ترحيل_اللاجئين_مطلب_شعبي (Deporting Refugees is A Popular Demand) spread, accompanied by content attacking refugees and holding them responsible for economic and social crises. Tunisia witnessed similar campaigns that used hashtags such as #لا_للتوطين (No To Settlement) and #لا_لتجنيس_عديمي_الجنسية (No To Naturalizing Stateless People), accompanied by rhetoric rejecting the presence of African migrants and warning of claims related to changing the demographic composition of the country.

The timeline of the posts shows that the hashtag #لا_للتوطين (No To Settlement) began to appear in Libya in late April 2026, as it was adopted by Libyan accounts and pages that used it to spread allegations about the existence of programs for the settlement of migrants within the country, and linked those allegations to claims regarding the "changing of the demographic identity" of Libya, despite the lack of evidence supporting these claims.

At the same time, other pages and accounts began reproducing the same discourse, calling for protests to reject what they described as "settlement," marking a new phase for the campaign in which it shifted from sharing hashtags to direct calls to take to the streets.

Calling for Protests Turned to Fueling Hate

With the widespread use of the hashtag “No To Settlement,” some Libyan pages and accounts began using it to call for protests scheduled for May 1, under slogans including "Open the sea to migrants."

The account "Militia Crimes" on Facebook and X was one of the first accounts to publish calls for these protests. An examination of the account shows that the page is relatively new; it was created on X in 2021, while it appeared on Facebook in 2024.

The page 'Exposing Officials' also repeated the call for protests, and a check of the transparency feature on Facebook showed that it was created in January 2026. It previously bore the name 'Zliten Youth Movement Against Settlement and Foreign Presence'.

By the end of April, the focus on calling for protests subsided, replaced by a new wave of posts that relied on stoking anger and fears toward refugees and migrants.

Videos and photos circulated alleging the burning of shops owned by Africans in the city of Zawiya. Additionally, several accounts circulated posts claiming there were efforts to naturalize African migrants and grant them Libyan citizenship, without providing documented evidence to support these claims.

Over time, the campaign was no longer limited to circulating allegations regarding "settlement," but increasingly turned to publishing content carrying hostile rhetoric toward refugees and migrants, portraying their presence as a security and social threat.

Disinformation Fueled Hate Speech

During the month of May, there was a surge in posts linking African refugees and migrants to repulsive practices and behaviors, following a recurring pattern aimed at fueling negative sentiment toward them.

Among the most widely circulated examples was a video posted by the Militia Crimes account, claiming it showed an African child eating raw cat meat. Other pages and accounts re-shared the clip extensively, accompanied by comments using inflammatory language against Africans. Additionally, other claims were promoted alleging their involvement in "black magic".

Despite the widespread dissemination of this type of content, its publishers did not provide evidence to support the accompanying allegations. Meanwhile, monitoring showed that the clip was used extensively in posts that included the hashtag “No to Settlement,” which contributed to boosting its spread and linking it to the escalating hate speech.

In a similar context, newly created or anonymous accounts shared posts containing misleading information regarding the existence of documents proving the implementation of projects to settle migrants in Libya.

Among these accounts is an account named 'Gahida TwTw,' which published a claim that the security apparatus in the city of Misrata raided the headquarters of an Italian organization and found documents inside related to plans for settling migrants.

Research into open sources and a review of data released by relevant Libyan authorities did not show any evidence of this raid taking place or the discovery of such documents, which suggests the claim was circulated without a documented basis.

This was not the only instance, as the campaign relied on recycling a number of unverified claims, republishing them across various accounts and pages, which contributed to increasing their spread and boosting interaction with them.

From Digital Interaction to Protests

An analysis of comments and reposts showed that posts carrying tags such as #لا_للتوطين (No to Settlement), #ترحيل_الأفارقة (Deporting Africans), and #طرد_منظمة_الهجرة (Expelling the Migration Organization) were not limited to circulating disinformation, but were accompanied by rhetoric inciting the rejection of the presence of refugees and migrants, calling for their deportation, and linking them to security and social problems.

The comments also saw widespread use of phrases describing refugees with insulting labels or stripping them of their status as victims, in addition to calls to take stricter measures against them.

The timeline of the posts shows that the pace of this rhetoric gradually escalated during the month of May, before reaching its peak in the days preceding the June 4th protests, when calls circulated on online platforms turned into field protests that took place in the vicinity of the United Nations Support Mission in Libya headquarters.

This timeline alone does not prove a direct causal link between online activity and field events, but it reveals a clear synchronization between the escalation of the digital campaign and the rise in the intensity of the protests, in parallel with the spread of misinformation and hate speech against refugees and migrants.

A Wide Digital Campaign Within One Month

To monitor the volume of online activity associated with the campaign, the investigation analyzed 1,800 posts published during the period from late April until June 4, 2026, all of which included tags related to attacking refugees and migrants in Libya, foremost among them the tag “No to Settlement,” which became the most present tag in the campaign's content.

Although the number of posts seems relatively limited, they achieved remarkable reach within a short period of time, as the total reach and views exceeded 284 million views, while the total interactions reached about four million, which are high figures compared to the volume of published content, which calls for examining the mechanisms of its spread and the nature of the accounts that contributed to amplifying it.

Facebook Dominated the Activity

The distribution of posts by platform showed that Facebook was the primary arena for the campaign, accounting for 79.41% of all monitored posts.

TikTok came in second with 11.34%, followed by Instagram with 4.37%, and then X with 3.87%.

The investigation also monitored the participation of:

• 464 accounts on Facebook.
• 112 accounts on TikTok.
• 63 accounts on Instagram.
• 38 accounts on X.

This distribution indicates that the activity was not confined to a single platform but extended across multiple platforms, with Facebook remaining the main driver for the circulation of hashtags and posts.

Peak Activity Coincided with the Protests

The timeline of the posts reveals a gradual escalation in the volume of published content throughout the month of May, before reaching its peak on June 4th, the day that witnessed the protests in front of the United Nations Support Mission in Libya headquarters.

During that day alone, 402 posts were monitored, the highest daily posting rate during the monitoring period. The posts also recorded the highest levels of reach and interaction, coinciding with the escalation of events on the ground.

This synchronization alone is not sufficient to prove a direct causal link between the digital activity and the protests, but it reveals a clear temporal correlation between the escalation of the discourse circulating on the platforms and the peak of the field events.

Hate speech was reflected in the most trending hashtags and words

The impact of the campaign was not limited to the volume of posts, but also appeared in the nature of the language used within them.

The hashtag cloud showed that the most trending hashtags were:

#ليبيا (Libya), #طرد_منظمة_الهجرة (Expel the Migration Organization), #لا_للإقامة (No to Residency), #ترحيل_الأفارقة (Deporting Africans), #لا_للتجنيس (No to Naturalization), and #الترحيل (Deportation).

These hashtags reflect the campaign's focus on rejecting the presence of refugees and migrants, with escalating calls to deport them or prevent their settlement within Libya.

The most used word cloud also showed the presence of phrases such as:

• "The Libyan people"
• "Illegal persons"
• "Illegal infiltrators"
• "Refugee Commission"
• "Cancel the decree"
• "No to residency"

Reading these words in the context of the posts shows that they were used repeatedly to describe refugees and migrants as a source of threat, or to demand measures against their presence.

It is also noted that the expressions "illegal persons" and "illegal infiltrators" were among the most used descriptions within the posts to describe refugees and migrants, which reflects the nature of the discourse circulating in the campaign.

Indicators Requiring Further Examination

This data shows that the campaign did not rely solely on posting a large number of posts; rather, it succeeded in achieving high dissemination rates within a short period of time, with recurring use of the same hashtags across different platforms and a clear synchronization in posting times.

These indicators alone are not enough to confirm the existence of organized coordination between all participating accounts, but they represent indicators worth examining, especially when read alongside posting patterns, the nature of the most active accounts, and the repeated messages carried by the posts, which the next part of the investigation will address.

What Indicates the Presence of Coordination?

The spread of a hashtag or high engagement rates alone is not sufficient to claim the existence of a coordinated digital campaign. This investigation did not rely solely on the volume of posts, but analyzed a set of indicators related to posting patterns, message repetition, and their spread across different platforms.

The analysis showed the repeated use of the same hashtags in a large number of posts, with the same messages being re-circulated in similar formats across different pages and accounts, in addition to a noticeable synchronization in the pace of posting during the periods preceding the protests. We also observed the participation of newly created pages, and pages whose usual activity is not political, in spreading the same hashtags and messages, which expanded their scope and reach.

In addition, the data showed that a relatively limited number of posts achieved remarkably high dissemination and engagement rates within a short period, in parallel with the recycling of the same allegations across multiple accounts. These indicators alone do not represent definitive evidence of the existence of a central management for the campaign, but when read together, they provide strong indications of a coordinated pattern in amplifying the hashtags and messages that accompanied the campaign.

Most Active Accounts: Who Led the Amplification of the Campaign?

A large portion of the circulating content did not come from media institutions or official entities, but from unknown news pages, newly created accounts, and pages with interests unrelated to political affairs, all of which participated in spreading the same hashtags and re-circulating repetitive messages.

We also monitored the use by some posts of hashtags carrying explicit racist discourse, among them #العنصرية_واجب_وطني (Racism is a National Duty), which reflects the level of escalation that some of the messages circulating during the campaign reached.

Accounts at the Forefront of Posting

At the forefront of the most active accounts was a Facebook account named "Hatem Ezwai," belonging to a real person who identifies himself as a doctor and a graduate of Zagazig University. He also openly declares his opposition to the Government of National Unity headed by Abdul Hamid Dbeibah and his hostility toward the Muslim Brotherhood.

During the monitoring period, the account published 160 posts, almost all of which included hashtags hostile to refugees, foremost among them #لا_للتوطين (No to Settlement).

Following that was "Al Khabar Al Yaqeen" (True News), a page that was created in 2024 and presents itself as an unofficial news page. It published 158 posts that included the same hashtags, making it one of the largest contributors to spreading the campaign's content. Despite the different nature of these two accounts, the similarity in the messages and hashtags used by both reflects a similar pattern in the content published during the monitored period.

Pages that participated in reproducing the discourse

The analysis also showed the activity of the "PsyCo M" page, which is managed by five people, four of whom are from Tunisia and one from France, according to Facebook transparency data.

The page previously participated in campaigns dealing with the migrant file in Tunisia, and in March 2026, it called for protests against what it described as the "settlement project," before publishing 47 posts during the monitoring period in Libya that included hashtags such as #طرد_منظمة_الهجرة (Expel the Migration Organization) and #ترحيل_الأفارقة (Deport Africans).

This activity alone is not enough to prove the existence of direct coordination between the two campaigns in Tunisia and Libya, but it shows the page's continued adoption of the same discourse when dealing with the migration file in more than one country.

The investigation also monitored the participation of the "Libya Original" page, a commercial page that advertises marketing and advertising services. Although its usual activity is not related to politics, it published 35 posts that included hashtags such as #ليبيا_لليبيين (Libya for Libyans) and #لا_للتوطين (No to Settlement).

The involvement of commercial pages in circulating these hashtags indicates the wide reach of the campaign and its access to accounts whose primary activity is not related to political issues.

 Political Pages and Accounts Adopted Sharper Rhetoric

Participation was not limited to news or commercial pages, but also included pages with clear political leanings.

The "Against the Brotherhood in Libya" page participated in publishing content linking the presence of refugees to allegations of implementing a project to settle Africans, while holding the Muslim Brotherhood responsible for it.

An account named "Al Aziz Yousef" also emerged, identifying its location in the city of Benghazi. The majority of its posts focused on attacking refugees and migrants, using hashtags such as #العنصرية_واجب_وطني (Racism is a National Duty) and #سحب_الجنسية_وطرد_الأجانب_مطلب_شعبي (Revoking Citizenship and Expelling Foreigners is a Popular Demand).

The account owner indicated in his profile information that he works in "Intelligence," and his cover photo shows a military vehicle bearing the number 106. This suggests that he may belong to the 106th Brigade, known as the "Border Guard" brigade affiliated with the Libyan National Army under Field Marshal Khalifa Haftar in the city of Benghazi, which is known for operating in border areas and engaging with other armed groups.

This does not allow for a definitive claim regarding his affiliation with the 106th Brigade of Haftar's army in eastern Libya, but it represents information worth noting as part of the data declared on the account, without the possibility of independently verifying its accuracy.

Indicators of Campaign Amplification

The data reveals that the campaign relied on a relatively limited number of posts, yet it achieved widespread dissemination within a short period, coinciding with the repeated use of the same hashtags and the re-circulation of the same messages across different accounts and pages.

Analysis also showed the participation of newly created pages, commercial pages, political pages, and anonymous accounts or those with limited previous activity in resharing the same content during the same time period.

These indicators, individually, do not prove the existence of a central management for the campaign or direct coordination between all participating accounts, but they are consistent with patterns usually observed in digital campaigns that rely on amplifying hashtags and reproducing messages across a large number of accounts and pages.

This Investigation Reveals

That the anti-refugee discourse in Libya was not limited to sporadic posts on social media platforms, but evolved over several weeks into a broad digital campaign that relied on repeating hashtags, recycling misinformation, and escalating hate speech toward refugees and migrants.

The timeline of the campaign also shows a clear synchronization between the escalation of digital activity and the rise in the intensity of the protests witnessed in Tripoli on June 4, 2026—protests that ended with an attempt to storm the headquarters of the United Nations Support Mission in Libya and the temporary closure of the UNHCR office.

Although the data reached by the investigation does not allow for proving a direct causal link between online activity and field events, it documents how the spread of disinformation, the repetition of inflammatory messages, and the widening scope of hate speech contributed to creating a digital environment more susceptible to escalating tensions toward refugees and migrants in Libya.

These findings highlight how disinformation campaigns and hate speech, when repeated and amplified across online platforms, can transition from the cyber sphere to influence events on the ground.