Connecting the dots: The far-right ideology of the Magdeburg suspect

19 February 2024 

By: Jakob Guhl 

On 20 December 2024, six people were killed and hundreds injured in an attack targeting a Christmas market in Magdeburg, the capital of the east German state of Saxony-Anhalt. Although the modus operandi and target were reminiscent of the 2016 Islamist extremist Christmas market attack in Berlin, in which 12 people were killed, reporting soon indicated the alleged Magdeburg attacker was an ex-Muslim from Saudi Arabia. Contrary to claims that the attack constituted a case of mixed or confused ideological motivation, ISD analysis of the alleged attacker’s online footprint on X suggests he consistently promoted far-right, anti-Muslim views over an extended period.  

---

Background: The Magdeburg attack and the debate about the alleged attacker’s ideology 

On 20 December 2024, six people were killed and 299 injured in a car attack targeting crowds attending a Christmas market in Magdeburg, the capital of the east German state of Saxony-Anhalt. The modus operandi and target were reminiscent of the 2016 Islamist extremist terrorist attack in Berlin. However, reporting soon indicated the alleged Magdeburg attacker Taleb al-Abdulmohsen was not an Islamist extremist, but an ex-Muslim from Saudi Arabia.  

Following the Magdeburg attack, significant public debate has emerged over the alleged attacker’s ideology, with many describing him as not fitting a clear category. This reflects broader discussions on the rise of hybrid, unstable or incoherent extremist ideologies. In Germany, the annual stats breaking down politically motivated criminality have evidenced a significant increase in cases that could not be categorised under clear ideological classificiations since 2020. 

This is not an abstract debate about definitions and categories. However, reporting since the attack has revealed 105 instances prior to the attack in which local authorities, police and intelligence services were alerted about the alleged attacker. It has been suggested that the reason why his case was deprioritised by authorities was because he allegedly did not fit a clear ideological category. Terrorism scholars have made the case that a new threat category that recognises offenders with “mixed and unstable motivation” is required. 

The importance of properly reviewing difficult cases and identifying the appropriate mechanisms for intervention has recently been highlighted in the UK with the investigation into the Southport attacker Axel Rudakubana, who killed three young girls at a Taylor Swift dance party in July 2024. Despite risk assessments from authorities, Rudakubana’s cases likewise had not been escalated over the years as he did not show clear signs of ideological radicalisation.  

Based on an analysis of the attacker’s online history, this article however argues that his ideology is neither new, mixed or confusing. Instead, we believe he can clearly be classified as being inspired by the counter-jihad movement, a loose network of bloggers, think tanks and organisations promoting anti-Muslim and often far-right ideas. It should be noted that the Magdeburg attacker’s ideological sympathies for the far-right are fringe among ex-Muslims and put him at odds with other activists from this community. 

Key takeaways 

• An ISD analysis of posts from the alleged Magdeburg attacker, show a clearcut far-right, anti-Muslim ideology. The alleged attacker’s ex-Muslim background may set him apart from previous attackers, but his content aligns with the counter-jihad movement – an ideology which emerged in the early 21st century and has become increasingly mainstream through far-right political parties. 

• Several posts showed strong support for far-right leaders and parties who have promoted anti-Muslim “counter-jihad” ideology. This included the German far-right party Alternative für Deutschland (AfD), as well as international far-right politicians and activists including Geert Wilders and Tommy Robinson, of the Netherlands and UK, respectively.  

• The alleged attacker repeatedly threatened the German state and civil society groups, accusing them of supporting Islam or failing to side with ex-Muslims. While his social media activity does not allow us to establish why the alleged perpetrator chose to attack a Christmas market, his posts became increasingly critical of Germany from 2020 onwards. He expressed a clear intent to commit violence, threatening politicians, ex-Muslims and German society. 

• The alleged attacker maintained strong thematic consistency over time. A review of 180 posts from X (formerly Twitter) over the past eight years found that almost 90 percent promoted either far-right politicians or anti-Muslim sentiments, or discussed broader issues such as the situation of ex-Muslims, women’s rights and domestic violence, homophobia in Muslim majority societies or philosophical and scientific criticisms of Islam (while these broader issues are not far-right, the alleged attackers interest in them does not appear surprising given his central focus on opposing Islam). 

• The attack does not appear to be part of the trend towards mixed or hybrid violent extremism. Media reporting and public debates claiming that the alleged attacker lacked a clear ideology are undermined by the clear support for established counter-jihad beliefs. While it is important to acknowledge the increasing trend of ideological hybridisation across contemporary cases of violent radicalisation, it is equally important for prevention efforts to provide more definitive ideological categorisations where appropriate. 

Approach to Analysis 

According to his profile on X¹ , al-Abdulmohsen tweeted 121.3K times between March 2016² and December 2024.³ However, through the social media analysis software Brandwatch, ISD was only able to access 117,271 tweets. Of these, 99,884 were in Arabic, 6,513 in English and only 527 in German. Additionally, 10,058 messages could not be assigned a clear language, many of which were simply calls to retweet a link or an account (e.g. in the hypothetic examples “RT @Elon Musk” or “RT X.com”).  

The alleged perpetrator slowly gained a significant number of followers over the years, reaching 30,000 in June 2022 and 40,000 by May 2023. Over the course of 2024, he slowly gained more followers, with a spike of more than 6K following the attack (see Figure 1).  

Based on data from the analysis tool Social Blade, the alleged attacker appears to have briefly enjoyed a rise of over 50K followers between August and October 2022, after which his followership dropped again to just below 40K. However, his posts during this time did not receive unusual amounts of engagement. While ISD cannot definitively state the reason for this anomaly, it is conceivable that the alleged attacker purchased inorganic followers on X that were later removed by the platform.  

ISD downloaded the alleged attacker’s entire X history via Brandwatch. Our analysts then reviewed the 20 most retweeted posts of each year from 2016 to 2024 (a total of 180 posts) in order to identify the key themes and targets that would provide us with indications about the alleged perpetrator’s ideology. 

When reviewing the gathered posts, ISD analysts inductively assigned themes to the content. Whenever new thematic categories were added which challenged previously established ones, all posts that had already been coded were reviewed again to ensure these were still appropriately labelled. This created an iterative process between an analysis of the content and the identification of themes. Where applicable, ISD analysts also noted the target of criticism of each post.  

Findings 

Contrary to claims the alleged attacker did not exhibit a clear ideology, his online footprint suggests a strong thematic and ideological consistency over time. Between March 2016 and December 2024, he repeatedly criticised Islam and its negative political and societal consequences on X. Only in extremely rare instances did the alleged attacker speak about issues unrelated to Islam, Muslims or Saudi Arabia. These cases included discussions about evolution and support for vaccines, in line with his emphasis on science over religious belief.   

Of the 180 posts, 159 fell under one of the following themes: 

• Support for far-right groups or figures 

• Promotion of anti-Muslim sentiments 

• The situation of ex-Muslims, and Germany’s perceived political support and tolerance for Islam 

• Women’s rights, domestic violence and homophobia in Muslim majority societies  

• Philosophical and scientific criticism of Islam 

Of the remaining 21 posts where a coherent topic could be identified, most were in line with these themes including criticism of Hezbollah and Qatar, complaints about media coverage about Islam or appreciation for Judaism.     

“The problem is Islam” – Essentialisation and demonisation of Islam and Muslims 

As far back as 2016, the alleged perpetrator described Muslims as intellectually inferior and primitive: “It’s not enough to explain truth 2 Muslims. You must 1st implant a new mind to replace their anti-fact disposition.” He held similarly hostile views towards Arabs, saying that in a planned book⁴ “arguments will be specifically simplified for Arabs. I have realized that Arabs do not respond very well to Western-styled arguments.” In September 2016, he contrasted Sunni-Shia sectarianism with Westerners desire to “invent something useful for humanity and add it to … [their] …. list of many inventions.” 

Similarly, he repeatedly portrayed Islamist extremism and terrorism as authentic expressions of the entire faith. For example, in February 2017, he retweeted a quote by author Sam Harris which says: “It is time we admitted that we are not at war w ‘terrorism.’ We are at war with Islam” (See Figure 4). In August 2017, the alleged perpetrator described Islam as “worse than the plague.” In July 2019, he made it clear that his goal was to abolish Islam entirely, arguing that “to exterminate Islam you must eliminate the emotional reflex that Muslims show as explosive anger when they hear critique of their religion.”  

These posts echo the beliefs of the ‘counter-jihad’ movement, a loose network of far-right bloggers, activists and think tanks who view Islam as totalitarian ideology that is incompatible with liberal values. Emerging in response to events such as the 9/11 attacks and rise of Islamist extremism – seen as the authentic expression of “true” Islam — the movement emphasises the perceived threat of an “Islamisation” in Western societies, which are seen as being in danger of transforming into a supposed “Eurabia”.  

The alleged perpetrator used his X account to promote conspiracy theories around the supposed dangers of “Islamisation”. In March 2016 for example, he warned about the “Islamization of Europe”, arguing that “many people underestimate the dangers inherent to Islam.” Later, in August 2016, he specified what he understood to be these inherent dangers: “Islamization means: The end of scientific edge, decay of art movements, and destruction of civilization.” To counter this, in March 2019, he advocated for the German government to “put the phrase ‘The Quran can be deadly’ on every copy of the Quran, echoing warnings on cigarette packages”. 

In December 2023, the alleged perpetrator retweeted a post promoting the Identitarian Swiss women’s group Collectif Némésis and criticising the “the Islamization of Switzerland.” In the same month, he also shared a post denouncing the alleged Islamisation of London and Europe. In March 2024, the alleged perpetrator shared a post accusing Islam of promoting “population replacement.” 

Support for far-right figures 

In addition to promoting counter-jihad ideas such as the “Islamisation” narrative, the alleged Magdeburg attacker also amplified a series of far-right parties and figures. In Germany, he repeatedly endorsed the far-right Alternative für Deutschland (AfD), especially in relation to its views on Islam, Muslims and immigration. In June 2017, the suspect stated that “I and the AfD are fighting the same enemy to protect Germany.”⁵ Notably, in December 2017, he retweeted a post by today’s AfD leader Alice Weidel blaming Islam for endangering and undermining Christmas markets and traditional celebrations (See Figure 5). While it is impossible to know why the alleged perpetrator chose a method and target closely associated with Islamist extremist attacks, it is clear he was aware of their symbolism.  

Following the deadly Mannheim attack in June 2024, in which an Islamist extremist attacked counter-Jihad activist Michael Stürzenberger and killed an intervening police officer, the Magdeburg suspect retweeted a post stating, “only from the AfD can we hope for a way out of the insanity.” In September 2024, the suspect reposted another video of Weidel in which she allegedly speaks about “the truth about immigration in Europe.” Notably, the video does not explicitly mention Islam or Muslims, instead promoting narratives that migration has increased crime.   

Beyond the AfD, the alleged perpetrator also expressed support for international far-right figures promoting Counter-Jihad ideology, including far-right Dutch politician Geert Wilders. In April 2019, the suspect retweeted a post in which Wilders justified legally revoking freedom of religion for Muslims; in 2020, he shared multiple tweets by Wilders calling to “Stop Islam” or “Stop Muhammadanism.” In August 2024, he shared a post calling Wilders a “hero.” 

As early as December 2016, the alleged perpetrator expressed support for the British far-right and anti-Muslim activist Tommy Robinson, the founder and former leader of the English Defence League (one of the major street movements in an earlier iteration of the counter-jihad movement). In May 2024, the alleged perpetrator retweeted Robinson stating that “using the word Islamism let’s [sic] Islam off the hook. The problem is Islam”. In October 2024, the alleged perpetrator shared a tweet by Robinson promoting his new book, which he claimed provided “all the evidence of the replacement of Europeans by the oligarchy.” 

“Justice at any cost” – Criticism and threats against the German state  

From 2020, the alleged attacker’s posts became increasingly critical of Germany and German authorities’ stance on Islam. Posts accused the German police and state of persecuting ex-Muslim and Saudi asylum seekers, while supporting political Islam. From 2019 onwards, he also targeted a secular refugee support organisation, accusing it of corruption, failing to properly investigate claims of sexual abuse and attempting to sue it repeatedly. Additionally, he threatened violent retribution against the German state and society due to public funding for this organisation. In one example in May 2024, the suspect wrote that he “expects to die this year” and that he “will bring justice at any cost” as “German authorities are impeding all peaceful pathways to justice.” viFollowing the June 2024 Mannheim attack, he argued that the “German police was the real driver of Islamism in Germany.” The alleged attacker also argued that the AfD as needed to “protect the police from itself.” 

Conclusion 

The suspect behind the Magdeburg attack clearly promoted a far-right ideology rooted in counter-jihad narratives and conspiracy theories. This included claims about the “Islamisation” of Europe, essentialised and demonised descriptions of Islam, and justifications for discrimination against Muslims. He frequently shared content by and expresses for key figures and organisations associated with the counter-jihad movement.  

Given the remarkably consistent beliefs in his online footprint over a period of almost nine years, confusion about his ideology appears to stem in part from his identity as a Saudi citizen who left Islam. While this is indeed an unusual background for a violent extremist attacker, the analysis above strongly suggests he was deeply immersed in ideological online ecosystem promoting far-right and anti-Muslim views.   

Another source of confusion is his choice to attack a Christmas market – an iconic, long standing German tradition – in an AfD stronghold with no substantial Muslim community. Similar vehicle attacks against public gatherings are generally more associated with Islamist extremists. Given the ideological views of the alleged attacker, Muslims or pro-immigration politicians might have been a more obvious target. It should however be noted that indiscriminate attacks by far-right perpetrators on iconic German festivals are not unprecedented. For example, in 1980, a far-right extremist attacked the Octoberfest, killing 13.  

It is notable that the alleged perpetrator’s posts became increasingly critical of Germany over the past five years. He clearly viewed the German authorities as culpable in the persecution of ex-Muslim asylum seekers and anti-Islam activists as well as the promotion of Islam. Whether the alleged perpetrator’ chose to attack a Christmas market as a way to inflict revenge on the German state and society will be a key question during his trial. 

Mixed and inconsistent ideologies deserve increased attention by policymakers, security agencies and researchers. This should however not mean that we simply refer to poorly understood but internally consistent ideologies as mixed or incoherent, if they do not fit the ‘usual’ mould. To more effectively limit the risk from extremist violence, we need to also provide more definitive ideological categorisations where appropriate. Clear ideological currents continue to pose serious security threats, even if they manifest in unexpected ways.  

Special thanks to Guy Fiennes for his research support for this article.  

End Notes

[1] X appears to have initially restricted some posts by al-Abdulmohsen, though most posts remained accessible until mid-January. Until then, X informed users that “This account is temporarily restricted”, though one click sufficed to open the full profile. 

[2] The alleged Magdeburg attacker joined Twitter in March 2016 and started tweeting on 5 March, announcing his intention to write a book called “Creative Refutation of Islam.” On the same day, Taleb al-Abdulmohsen tagged various high-profile atheists, ex-Muslims and Saudi human rights activists such as Richard Dawkins, Hamed Abdel-Samad, Maryam Namazie and Loujain al-Hathloul, asking them for retweets to spread awareness for his crowdfunding campaign to finance the book. Overall, he received four donations for £110, falling well short of the set goal of £81,675. He claimed he “I invented many intuitive arguments to show that Islam did not come from a divine source and thus should be largely reformed or fully abandoned.” He also claimed he had “finally found the formula to enlighten at least 10% of Muslims.” A parallel campaign to fundraise for an Ex-Muslim academy did not receive any donations. 

[3] The alleged attacker remained highly active though this period of time though he stopped using X almost entirely throughout the summer of 2018. 

[4] See endnote 2.

[5]  In the same year, he appears to have contacted the AfD to establish a group of Ex-Muslims within the party, though this initiative failed to materialise.