The campaign that pulled crowds to the Ceuta border this summer was visible in open data while it was still building: for weeks before the first crossing, the same recruitment texts were being pushed across public Facebook groups in coordinated runs.

We analysed 25,335 posts and comments from nine digital platforms and followed the operation of mobilising people online for the crossings.

Calls to head for Ceuta were spreading through public Facebook groups weeks before the mass border crossings of 30 July. Posts landed in different groups almost simultaneously: on 29 July, the same text appeared word for word in six groups within 81 seconds, and the same sequence repeated three times that day.

The gaps between posts ranged from 2 to 122 seconds, but the sequence never changed: the same text always travelled through the same groups in the same order, and the posting rhythm repeated day after day. Researchers read this as the mark of a coordinated campaign.

Snapshot from the Repsense report (accessible here).

The fourteen-group network

The campaign built no infrastructure of its own. Instead, it used communities that were already running: the posts went out in fourteen Facebook groups where Moroccans living abroad, or preparing to leave, trade advice on visas, transport and work in Europe. Among the everyday questions, the recruitment messages stood out in no way at all – which made them hard to spot, and harder still to remove, since that would mean shutting down groups where real people talk to each other.

"Platforms have learned to recognise fake accounts and bot amplification. This campaign left no such trace – it borrowed real communities and a real audience. We see the same tactic in campaigns across CEE: existing groups taken over for a new purpose – and it works because it is cheap to run and harder to remove," says Mykolas Katkus, CEO of Repsense.

Node size and number = cross-posted posts the group carried, i.e. posts whose text also appeared in at least one other group (1 Jul – 16 Aug) · teal chords = texts shared between two groups · dashed spokes = groups that carried @haraga_europa_900. Snapshot from the Repsense report (accessible here).

Members wrote about setting out and named their departure points: Casablanca, Marrakech, and as far as Jijel on the Algerian coast, about 1,300 km from Ceuta.

What has Harry Styles got to do with a border crossing?

The campaign also gave itself away through an unexpected detail – pop-culture hashtags. Part of the captured posts ended in the same set of tags: #harrypotter, #harrystyles, #harleydavidson, #hairstyle, #happyvalentinesday. None of them has anything to do with migration, but all of them start with the letters "ha" – just like the campaign's core tag, #haraga, an Arabic word used across North Africa for crossing a border illegally. When the author typed the first two letters into a phone, the screen offered the most popular tags, and they were accepted with a single tap.

The technique is known as hashtag hijacking, or riding trending tags to place content in feeds it would never reach on its own – in this case, entertainment feeds. Here it did a second job as well – it kept the posts out of sight of keyword checks built around migration.

The public posts did only the advertising – the recruitment itself moved to private channels. The campaign's posts carried 22 different WhatsApp contacts: 9 group links and 13 phone numbers, registered in Morocco, Egypt, the Netherlands and Spain. The contacts changed roughly every week: as one went quiet, a new one appeared. "Rotating contacts weekly is operational security," said Katkus. "Someone maintained this layer – numbers were retired before they could draw attention, the way burner phones are swapped. Spontaneous community organising does not look like that."

What the posts promised

The recruitment ran on a handful of short texts, re-posted across the ring for weeks rather than written fresh each day. One line – "It is the beauty of Europe I am speaking of" – appeared repeatedly from late July to mid-August. Another was a blessing, "May God make it easy for you, and for everyone". It was posted every few days through July, both on Instagram and in the Facebook groups.

Some posts mocked the border itself. One from early August jokes about "the youngest harrag" – harrag is the word for a person who crosses a border illegally, and the post describes a small child who, it says, goes into Ceuta whenever he wants and comes out whenever he likes. If a child can cross, the border does not hold.

One post from 30 July reaches for the audience's own history: "A mass departure towards occupied Ceuta. Go to Abyssinia (Spain), it has a king under whom no one is wronged." The second sentence is the Prophet's instruction to the first Muslim emigrants, sent to Abyssinia to escape persecution in Mecca – but with Spain written in where Abyssinia stood. This the crossing as a hijrah, emigration with a religious precedent behind it.

*“A mass departure towards occupied Ceuta. Go to Abyssinia (Spain), it has a king under whom no one is wronged”*

On the day of the mass crossing the groups filled with scenes of departure: a family walking towards the border, a waiter who left his customers' coffee on the counter and ran to join them, teenagers gathering beside the Bab Sebta crossing. For a reader who had spent weeks hesitating, posts like these say one thing – people like you have decided, and waiting means being left behind.

From posts to crowds: what a campaign like this does

The campaign's impact was physical: posts built on a false reading of a Spanish court ruling spread for weeks, and people set out from across Morocco.

Europe has seen online recruitment move people before. In 2021, social media ads and travel agencies promised an easy route into the EU through Belarus; people flew to Minsk and were pushed toward the Lithuanian, Polish and Latvian borders, in a flow the EU called a hybrid attack and an instrumentalisation of migrants. The Ceuta posts made the same kind of promise and spread it through media people already consume and trust.

"What this study documents is mobilisation infrastructure," said Katkus. "Established communities with a real audience, coordinated post distribution through a network of groups, and recruitment in private chats – that set of components can carry any cause that needs a crowd in a place on a date, from a border to a protest square. The audience stays assembled, and the cost of pointing it at a new target is one text and one click."

The machinery is still in place

The morning after police stopped the second crossing attempt, an identical post appeared in seven of the same groups within 94 seconds – at a similar speed to July – this time on an entirely different topic, unrelated to migration.

Whether the crisis itself has passed is not clear: the groups still carry practical listings, including wetsuits offered for sale – equipment used for swimming crossings. What is clear is that the machinery that mobilised this summer's Ceuta border crossings will outlive the campaign.

"The groups and the tool are in place, and they can be pointed at another date or another cause," said Mykolas Katkus. "Choosing not to monitor this is no longer affordable: what begins as posts in a few Facebook groups arrives at the border as a crisis weeks later. We track that network continuously – and since all of this sits in open data, border authorities and platforms can watch it too."

Full report

Repsense maps the narratives shaping public conversation – where they originate, how they travel through different media channels, and which actors are pushing them. The platform separates organic discussion from coordinated and inauthentic activity, then quantifies each narrative's reach and impact so teams can see what is gaining ground before it becomes a problem.

Ceuta Crisis Was Visible Before It Happened – And The Next One Will Be Too