How IS uses Pashto on X to avoid detection
IS extremists are posting in the low-resource language to evade detection on X, a tactic that exposes the platform’s vulnerability.
The Islamic State (IS) terrorist group is using Pashto, a language not spoken in Africa, to avoid detection when spreading extremist ideas, announcing attacks, and expressing anti-Western narratives on social media.
Extremist groups use various tactics to avoid social media detection and have now adopted low-resource languages. By exploiting tongues that algorithms have not been trained to pick up, these groups slip past major platforms’ detection measures with alarming efficiency.
From January 2023 to January 2024, Code for Africa identified 91 incidents of extremist content targeting African countries using the Pashto language.
Pashto, an Indo-Iranian language with deep historical roots, is primarily spoken in the Pashtun-dominated regions in Afghanistan and Pakistan. In Afghanistan, Pashto is one of the official languages and holds significant cultural importance, particularly in the southern and eastern provinces. It is widely spoken in the northwestern regions of Pakistan, including Khyber Pakhtunkhwa and parts of Balochistan. The Pashtun diaspora contributes to the language’s presence in various countries.
The use of Pashto by IS and affiliated groups is prevalent in the Afghanistan-Pakistan region, particularly in Pashtun communities. According to reports by BBC Pashto Service and the United States Institute of Peace, various militant groups, including the Taliban, Tehrik-i-Taliban Pakistan (TTP), and IS, have exploited Pashto as a tool for recruitment, sharing propaganda, and communication in Pashto-speaking regions susceptible to the influence of extremist ideologies. Pashto serves as a linguistic thread binding these groups and their sympathisers and allowing them to coordinate activities, while minimising the risk of detection.
However, using Pashto to report on terrorist attacks in African regions is relatively new. Although CfA first identified this tactic in August 2023, it might have been used previously. Since then, there have been at least 20 specific incidents in which X (formerly Twitter) failed to detect extremist content covering and targeting African countries in Pashto and left the posts up — until April 2024 — for users to find and interact with.
- Pashto-speaking content on X encouraging extremism in Mali
On 09 January 2024, a Pashto-language X account promoted Az-zallaqa content in Mali. The account used screenshots from Az-zallaqa website to share news about Islamist groups’ victories. Az-zallaqa is an Islamic extremist platform known for posting and sharing extremist news, particularly in the Maghreb region (Algeria, Libya, Mauritania, Morocco, and Tunisia). It is affiliated with Al-Qaeda in the Islamic Maghreb. Az-zallaqa is officially listed as the media arm of the terrorist organisation Jama’a Nusrat ul-Islam wa al-Muslimin (JNIM) by the US department of state.
The Pashto-language account bypassed the platform’s moderation despite using the same hashtags used by Az-zallaqa on Chirpwire, unlike extremist content in Arabic, which was quickly suspended or removed.
For instance, on 22 August 2022, an Arabic account called for people to mobilise and fight against ‘the infidel government and its allies’, referring to the Malian government and Wagner Group. This post was taken down within a couple of days and the account was suspended. The swift action taken to remove the Arabic post highlights the effectiveness of moderation tools for some languages. However, the fact that the Pashto account, using identical tactics, remained active for much longer demonstrates a gap in identifying extremist content in low-resource languages.
2. News about death of a JNIM leader
On 24 November 2023, an X account with the handle @Anas_M_J_R01 used Pashto to cover the death of the leader of the Malian extremist group JNIM. Unlike in this instance, the account does not usually post about Mali-related information and focuses its posts on jihadist updates.
3. I’lam News reshares executions
On 23 August 2023, I’lam News reshared pictures of the capture and execution of two people accused of being Wagner spies in Mali. The post’s caption was written in Pashto. I’lam News previously shared these pictures with an Arabic caption on its website on 09 August 2023.
From individual incidents to a network of accounts
Using a query in Pashto, CfA uncovered a network of active accounts on X that share and amplify extremist content.
Table one lists active X accounts that posted extremist content in Pashto.
The accounts have a pattern of cross-sharing posts about Mali in Pashto. A recent example is a post about how JNIM destroyed a Malian army checkpoint, killing two soldiers and injuring many others.
An analysis of 91 X accounts found the top three most-amplified accounts were @ahmadsaeed101, @pahlawa66593440, and @Armani_Ashna314.
These three accounts were created in 2022, 2020, and 2022, respectively, with a combined ~53,000 followers. They primarily comment on politics. @ahmadsaeed101 uses the verification feature to post long opinions on Middle East political affairs, whereas @pahlawa66593440 uses memes and pictures of jihadi figures to comment on the news, and @Armani_Ashna314 uses photoshopped images to share anti-Western opinions.
These accounts regularly share screenshots and news from Az-zallaqa about IS and JNIM victories; however, unlike the content shared in Arabic and English, X fails to detect and take down these celebratory posts.
Extremist groups’ use of Pashto exposes a critical gap in social media content moderation. Unless platforms invest in resources to handle low-resource languages like Pashto, these groups will find new ways to exploit these blind spots to spread hate speech and target vulnerable populations.
This article was co-written by iLAB investigation analysts Lujain Alsedeg and
Tagwa Warrag. It was edited by iLAB copy editor Theresa Mallinson and iLAB insights manager Nicholas Ibekwe.
This report was produced as part of the Congress for Peace (COPP) initiative at the African Digital Democracy Observatory (ADDO), to improve local understanding of how online extremism undermines public trust in democratic institutions in Burkina Faso, Côte d’Ivoire, Mali, and Niger. COPP is supported by the US State Department’s Bureau of African Affairs, Office of Public Diplomacy and Public Affairs (AF/PDPA). ADDO is a nonpartisan network of independent research institutes focused on analysing information manipulation and online harms across Africa. ADDO is managed by Code for Africa (CfA).
