On Thursday, former Kenyan Deputy President Rigathi Gachagua returned to Nairobi's Jomo Kenyatta International Airport (JKIA) after a six-week tour of the United States, which ended abruptly after just 43 days.
However, his return became the focal point of a disinformation campaign on X, where a network of accounts flooded the platform with fabricated narratives portraying it as a 'shameful' failure. These narratives included claims of violence and road closures, as well as the involvement of the outlawed Mungiki sect.
Hashtags such as #ExpresswayClosed, #FromUSwithShame and #ShamefulReturn gained traction, amplifying a coordinated effort to discredit Gachagua and promote rival political agendas.
Analysing X data revealed a deliberate attempt to manipulate public perception in Kenya's polarised political landscape, showing the structure, tactics and implications of the coordinated campaign.
Rigathi Gachagua's US tour
Rigathi Gachagua, often nicknamed 'Riggy G', served as Kenya's deputy president from September 2022 until his impeachment in October 2024. This was the first impeachment under Kenya's 2010 Constitution and stemmed from allegations of corruption, ethnic incitement, insubordination, and undermining of President William Ruto's administration.
Gachagua's falling out with President Ruto echoed a historical pattern in Kenyan politics where presidents often clash with their deputies, fuelled by power struggles and ethnic factionalism.
Gachagua embarked on a tour of the US starting on July 9, 2025, ostensibly to engage with the diaspora and rally support for his new Democracy for the Citizens Party (DCP).
His return was anticipated amid political tensions, including upcoming by-elections and his vocal criticism of President Ruto's government.
The Disinformation campaign: Hashtags, timing and volume
The campaign peaked on August 21, 2025, between 7:03 am and 1:19 pm EAT, aligning with Gachagua's arrival. A keyword search for "(#ExpresswayClosed OR #FromUSwithShame OR #ShamefulReturn) since:2025-08-21 until:2025-08-22" yielded over 50 posts, predominantly negative portrayals of Gachagua's return as chaotic and embarrassing.
The hashtag #ExpresswayClosed appeared in posts claiming that road blockades had been caused by 'Mungiki thugs' who were linked to Gachagua. Meanwhile, the hashtags #FromUSwithShame and #ShamefulReturn were used to mock his tour as a 'failed USA tour'.
A separate search for "Mungiki at JKIA" between August 21 and 22 revealed 30+ posts depicting armed gangs at the airport. Together, these keywords painted a narrative of ethnic violence, evoking Gachagua's alleged ties to the Mungiki gang.
Posts often shared identical videos and images, suggesting centralised scripting.
Manipulation tactics: Fabricated media and coordinated messaging.
1. Fabricated news reports: Multiple posts featured manipulated media, such as fake TV lower-thirds and graphic cards, AI-style caricatures and repeated text fragments, e.g. 'Mungiki at JKIA', which suggest a coordinated narrative.
Analysis of these posts' IDs revealed recycled footage from past events that had been edited to include Citizen TV logos. These posts claimed that there had been 'Mungiki at JKIA' disruptions, but they lacked verifiable timestamps.
2. Manipulated graphics: The fake Moja Expressway statement was widely shared.Other graphics altered mainstream media cards to imply that Gachagua had delivered "shameful" speeches in the US.
3. Cartoon illustrations and AI-generated images : Posts featured satirical cartoons of Gachagua in humiliating situations, some of which appeared to be AI-generated.
4. Keyword repetition and shared assets : Phrases such as 'Mungiki at JKIA' appeared consistently. Identical illustrations and videos were reused, suggesting an organised network rather than organic virality.
Recently, there have been repeated waves of hashtag-driven disinformation during political flashpoints. This case demonstrates an advanced tactic of combining the authority of mainstream brands with AI-generated imagery to amplify false narratives.
