Download
← All fact checksMorning run · November 9, 2026 · #8 by reach
CrimePoliticsRumour

Was the Kraków attacker Michał Oksiński a leftist antifascist who mocked Christianity?

Was the Krakow Market Square gunman a left-wing antifa 'anarcho-communist', not a right-winger as the government says, and were his Facebook accounts deleted by someone after the attack?

Misleading

The family deaths are real; the 'leftist' label and the cover-up question are not established.

MISLEADING. Police did confirm that the Kraków attacker's father, mother and sister were found shot dead in the family flat in Ostrowiec Świętokrzyski on 7 November 2026. But the claim that Michał Oksiński was a left-wing anarcho-communist rests on unverified 2019-2021 screenshots, and the suggestion that the government had his Facebook accounts deleted is unsupported.

+7Sources ↓Original post ↗
Likely genuine
The post as it circulated, labelled by our media check.Image

Claims

✓ 2 true

Michał Oksiński was an ordinary leftist, antifascist and anarcho-communist who mocked Christianity at every turn257

“Michał Oksiński to zwykły lewak, antifiarz i anarchokomunista. Na każdym kroku wyśmiewał chrześcijaństwo.”

– UnverifiableCentral claimLow confidence

This is the claim the whole post rests on, and it is the weakest link. It rests entirely on screenshots attributed to a Facebook account bearing his name from 2019-2021, when he was 17 to 19 years old. No one has established that the account belonged to him, or that the posts are genuine. Reporters who looked at the images said they were not conclusive and could not be verified. Against that, the Kielce prosecutor's office said no traces of active political or extremist activity had yet been found and that his online history was still being examined, while other reporting describes a Falanga national-radical emblem on his clothing at the arrest. Teenage social-media posts, even if authentic, are not a reliable statement of an adult's ideology. The sources pointing the other way are independent national outlets, but the screenshots themselves trace back to a single unverified origin, so they count as one source, not several.

Still open: Were the screenshots genuinely posted by Oksiński's own account, and if so, do teenage posts from 2019-2021 say anything about his views in 2026?

The attacker's two parents and his sister were found dead in the family flat in Ostrowiec Świętokrzyski1310

“jego dwoje rodziców i siostrę znaleziono martwych w mieszkaniu”

✓ TrueHigh confidence

This part checks out and is the post's anchor of truth. The national police spokesman confirmed that the three bodies found on the evening of 7 November 2026 in a block in central Ostrowiec Świętokrzyski were the attacker's father, aged 53, his mother, aged 52, and his sister, aged 21, all with gunshot wounds. The Kielce prosecutor's office opened a murder investigation covering these three deaths. Three independent outlets — a national broadcaster, public radio and a weekly — carry the same confirmation, and a Spanish daily reports the same details, so the corroboration is strong and does not depend on a single origin. A reader should weigh this as established fact. The problem is what the post does with it: a real and terrible detail is used to make the surrounding speculation feel trustworthy.

The government wants the public to believe the attacker was a right-winger9

“Rząd chce żebyś uwierzył, że to prawak.”

✓ TrueHigh confidence

The factual core here is accurate: Interior Minister Marcin Kierwiński did say on the evening of the attack that preliminary findings indicated the suspect was fascinated by far-right, ultranationalist ideology. That statement is on the record and is reported by an independent outlet. What is not supported is the caption's implication — that the minister's statement is a deliberate lie. Whether the preliminary assessment is correct is a separate question that is still unresolved: prosecutors say no confirmed extremist affiliation has been announced, and the evidence points in more than one direction. The post takes a real official statement and reframes it as a cover story without offering evidence of deception.

Still open: Was the minister's preliminary assessment correct, and what will the ongoing investigation conclude about motive?

Someone deleted the attacker's two Facebook accounts, implying an official cover-up46

“Pytanie tylko, kto usunął dwa konta zamachowca na Facebooku”

~ MisleadingModerate confidence

It is reported that the Facebook profile attributed to the suspect could no longer be accessed after the attack, so the observation is not invented. The problem is the insinuation attached to it. No evidence links the removal to the government or police. Platforms routinely remove the accounts of mass-shooting suspects, and reporters noted the account was not publicly reachable in any case. The rhetorical question — 'who deleted them?' — invites the reader to conclude there was official interference, which is a leap the reporting does not support. Polish digital-affairs officials were at the same time warning about a wave of false material around the case. The sources describing the inaccessible profile are not independent of each other in the strict sense, and one of them is a piece that itself promotes the cover-up angle, so it should be read with care.

Still open: Who, if anyone, removed the account, and on what grounds?

What was posted

X

An X post shares a collage of four Facebook screenshots attributed to the Kraków attacker: a 'temporary profile picture' post dated 5 December 2019 under his name, a photo of a hand holding a beer bottle next to a picture of a bishop, and two comment threads in Polish. The caption asks readers to believe the attacker was a left-wing antifascist and anarcho-communist who mocked Christianity, that the government is lying about him being a right-winger, and that someone removed his Facebook accounts as part of a cover-up.

“Michał Oksiński to zwykły lewak, antifiarz i anarchokomunista. Na każdym kroku wyśmiewał chrześcijaństwo. Rząd chce żebyś uwierzył, że to prawak. Pytanie tylko, kto usunął dwa konta zamachowca na Facebooku, skoro jego dwoje rodziców i siostrę znaleziono martwych w mieszkaniu?”

“Michał Oksiński is an ordinary leftist, antifascist and anarcho-communist. At every turn he mocked Christianity. The government wants you to believe he's a right-winger. The only question is who deleted the attacker's two Facebook accounts, given that his two parents and sister were found dead in the flat?” — translated

Posted on X by the account @Edgar_Korona on or about 8 November 2026, the day after the Kraków attack. The screenshots in the collage are dated 2019-2021.

Who posted it

X
@edgar_korona
View the account on X ↗

Account check

Looks like a genuine account24%
Likelihood of automation33%

Estimates from public signals — account age, posting pattern, audience — not a judgement of the person behind the account, and separate from whether this post is true.

What stood out

  • Account is an anonymous Polish-language nationalist/right-wing persona ('Edgar Korona'), no display name, bio, follower count or creation date available — identity not publicly attributed to any named journalist or organisation.
  • Same operator appears to run the linked handle @EdgarWolnosc ('Edgar Wolność Polska'); the two handles repost the same content, forming a single cross-platform persona (also active on Threads).
  • Documented fact-check: the linked @EdgarWolnosc handle was found by Fakenews.pl (Feb 2024) to have amplified a video with a false caption claiming Ukrainians with a knife were involved in a Wrocław brawl; the post reached 600k+ views and also got the location wrong.
  • April 2026 post claiming '~3000 Ukrainians protested in Wrocław' repeats a figure Ukrainian fact-checkers (Detector Media, inPoland) describe as heavily inflated and tied to a paid/possibly Russian-instigated provocation later recycled by Russian propaganda channels.
  • On 7 Nov 2026, in the immediate aftermath of the Kraków mass shooting, the account asserted the suspect was a 'leftist, anarcho-communist, Antifa supporter' — an unverified counter-claim picked up by foreign outlets (Icelandic blog, Slovak TA3 credited its photo) while police urged the public not to circulate unconfirmed details.
  • Content pattern is opinion-driven and emotive (anti-Ukrainian/UPA framing, migration and crime stories, PiS/Konfederacja-adjacent politics), typically images/short clips with assertive captions and few or no primary-source links.
  • Continuous activity since at least 2023 with a consistent voice and ideological line suggests a human-run account rather than a purely automated bot, but its themes align closely with narratives amplified by Russian-aligned networks.
Signals (7)+
Posting cadence
High; multiple posts per week including rapid reaction to breaking news
Identity transparency
Pseudonymous; no masthead, outlet or authorship disclosure found
Cross platform presence
X (@Edgar_Korona, linked @EdgarWolnosc) and Threads (@edgarkorona)
Fact check history
Cited in Fakenews.pl debunk (Feb 2024) of false 'Ukrainians with knife' Wrocław brawl claim; '3000 Ukrainians in Wrocław' figure flagged as inflated by Detector Media/inPoland (Apr 2026)
Notable news coverage
Quoted/cited by Icelandic Thjodolfur, Slovak TA3 and other outlets for Kraków shooting claims (Nov 2026); used as source by Polish right-wing blogs
Engagement
Single posts observed at ~50k and 600k+ views; follower count unknown
Narrative alignment
Anti-Ukrainian, anti-immigration, nationalist-right; overlaps with themes pushed by Russian propaganda outlets

Account checked November 9, 2026, 03:06 UTC

The media

Image
Likely genuinePresented as real footage· The claim depends on it

✓ What is genuine

The image reads as a straightforward compilation of real screenshots. The problem is not image manipulation; it is attribution and the conclusion drawn from old posts.

The tells

  • ●●● Strong signal Detector scored the image as not AI-generated at 0.995, with an AI-generated score of 0.0046 and a deepfake score of 0.012.our detector
  • ●●○ Supporting signal The Facebook interface elements are internally consistent — reaction counts, the 'od autora' badge, avatar thumbnails and timestamps such as '5 lat(a)'.our visual review
  • ●●○ Supporting signal The Polish text is coherent and correctly spelled, with no warped geometry, duplicated elements or garbled lettering.our visual review

Synthetic-media detector

Detector ran

The claim stands or falls on whether the media is real, so the detector ran.

AI-generated likelihood0%
Deepfake likelihood1%

Scores are the detector’s estimate for the file as uploaded. A low score does not rule out editing, a spliced caption, or footage shown out of context — those are judged above. Model v3.

How we checked the media

  • Reviewed the collage visually: four Facebook screenshots with interface elements, timestamps and Polish comment threads.
  • Ran the image through our AI-generation detector (hive-v3).

Sources

10 sources reviewed

Further reading

  • 4Konkret24 A fact-check of a different false asset in the same case, showing how quickly AI-generated material spread after the attack.
  • 2Polskie Radio 24 The prosecutor's statement that no active extremist activity had been traced, which is central to the open question of motive.
  • 9Vijesti Records the interior minister's preliminary assessment of far-right sympathies.

The full story

On 7 November 2026 a 24-year-old gunman drove into Kraków's Main Market Square and opened fire on passers-by, killing six people and wounding about sixteen, including two police officers who stopped him. That evening police found the bodies of his father, mother and sister, all with gunshot wounds, at the family flat in Ostrowiec Świętokrzyski. Prosecutors are investigating him for nine murders with a terrorism classification.

The motive is genuinely unresolved, and that is the space the post fills. Interior Minister Marcin Kierwiński said preliminary findings pointed to far-right, ultranationalist sympathies. At the same time, screenshots attributed to the suspect's old Facebook account show anti-clerical posts and talk of an LGBT flag, and other reporting cites a Falanga national-radical emblem on his clothing at the arrest. Those details pull in different directions, and no confirmed extremist affiliation has been announced. The prosecutors say they have not yet found traces of active political or extremist activity and are still examining his online history.

So there is a kernel of truth: a real attack, real family deaths, real screenshots attributed to him, and a real official statement about his views. The post arranges those real elements to imply a conclusion — that he was a leftist and the government is covering it up — that the evidence does not reach. The hook works because the deaths are true and shocking, and because a genuine open question about motive makes almost any theory feel possible.

Kernel of truth

Police confirmed the attacker's parents and sister were found shot dead in the family flat, and the interior minister did publicly describe preliminary findings of far-right sympathies.

Timeline

  1. November 7, 2026

    A 24-year-old gunman opens fire in Kraków's Main Market Square, killing six people and wounding about sixteen; two police officers stop him.

  2. November 7, 2026

    That evening police find the bodies of the attacker's father, mother and sister, all shot, in the family flat in Ostrowiec Świętokrzyski. 1TVP Info

  3. November 7, 2026

    Interior Minister Marcin Kierwiński says preliminary findings indicate the suspect was fascinated by far-right, ultranationalist ideology. 9Vijesti

  4. November 7, 2026

    Screenshots of an account bearing the attacker's name, dated 2019-2021, begin circulating on X and other platforms.

  5. November 8, 2026

    The collage and caption are posted on X, questioning who deleted the attacker's Facebook accounts.

How it was framed

Misleading contentFalse context

The post uses a real attack, real family deaths and genuine-looking screenshots, but arranges them to frame the attacker as a left-wing extremist and the government as covering it up. The screenshots are old and unverified and the cover-up question has no supporting evidence, so the misleading effect comes from framing and context rather than from fabricated images.

  • Us vs. them. 'Michał Oksiński to zwykły lewak, antifiarz i anarchokomunista' sets a left-wing identity against 'the government' and 'prawak' (right-winger).
  • “Visual proof”. The collage of Facebook screenshots is presented as self-evident proof of his views.
  • Emotional language. 'Na każdym kroku wyśmiewał chrześcijaństwo' ('at every turn he mocked Christianity') and the reference to his murdered family.
  • Missing context. The screenshots are dated 2019-2021, when he was 17-19, but the caption presents them as his settled identity.
  • Unnamed insider. The rhetorical question 'kto usunął dwa konta zamachowca' ('who deleted the attacker's two accounts') implies an unnamed actor without evidence.

Posted on X by the account @Edgar_Korona on or about 8 November 2026. The account's display name and follower context are not recorded in our materials.

Bias

NoneSlightModerateStrong

Leans Polish right-wing / anti-Tusk government, conspiracy-tinged. The post is written as an explicit attack on the government's account of the Kraków attack, using loaded labels ('ordinary leftist, antifascist, anarcho-communist') and a rhetorical question about deleted accounts to suggest a cover-up, while presenting unverified teenage screenshots as settled proof of the attacker's ideology.

Bias describes how the post frames its message — the slant of the language, selection and emphasis — and is judged separately from whether the claim is true. A true claim can still be framed with a strong slant.

How we checked

1 min 38 s
  1. 1

    Searched in Polish and English for reporting on the Kraków attack, the family deaths and the suspect's online history.

  2. 2

    Compared the family-death claim against police and prosecutor statements reported by several independent outlets.

  3. 3

    Reviewed the collage visually for consistency of interface elements, timestamps and text.

  4. 4

    Ran the image through our AI-generation detector.

✓ Claim checked✓ Media checked✓ Sources checked

Why 70% confidence

Moderate

We set confidence at MODERATE rather than HIGH because the central ideological claim is genuinely unverifiable: the screenshots are old and of contested attribution, and the investigation is still open. The parts we can confirm — the family deaths and the minister's statement — are well sourced, which is why the overall verdict is not lower.

Limits. We could not verify who ran the Facebook account in the screenshots or whether the posts are genuine. The investigation into motive is ongoing, and no final conclusion has been published.

What we don’t know

  • Whether the Facebook account in the screenshots genuinely belonged to the attacker.
  • What the investigation will conclude about his motive and any extremist affiliation.
  • Who, if anyone, removed the Facebook profile, and on what grounds.

Spot it yourself

Spot the fake

Looks suspicious, isn’t proof

  • The account is partisan and the tone is alarmist. That is a reason to slow down, not proof the facts are wrong.
  • The screenshots are old, low-resolution and cropped. Poor image quality proves nothing either way.
  • The post asks a loaded question instead of making a claim. A question can still mislead, but it is not evidence.

The actual evidence

  • The family deaths are confirmed by the national police spokesman and the prosecutor's office, reported by several independent outlets — so that part is true.
  • The 'leftist' label depends on screenshots from 2019-2021 that reporters describe as inconclusive and unverifiable, and prosecutors say no active extremist activity has been traced.
  • The interior minister's statement about far-right sympathies is on the record — it is real, even if its accuracy is still being tested.
  • No source links the removal of the Facebook profile to the government or police.
  1. 1

    Check the date on the screenshots.

    Look for timestamps such as '5 lat(a)' (5 years ago). Old posts show what someone said as a teenager, not what they believe now.

  2. 2

    Ask who would be reporting this if it were true.

    A claim that the government engineered a cover-up would be pursued by independent national outlets. If only partisan accounts carry it, treat it as unconfirmed.

  3. 3

    Separate the confirmed fact from the conclusion.

    The family deaths are confirmed; the ideology and the cover-up are not. A true detail can sit next to an unsupported one.

  4. 4

    Look for the official account of motive.

    Prosecutors and police statements are the place to check what has actually been established, rather than screenshots shared on social media.

Takeaway

A post can be right about one shocking fact and wrong about the conclusion it builds on it. Check each claim separately, and treat old screenshots as a question about attribution, not proof of identity.

Questions people ask

Were the attacker's parents and sister really found dead in the flat?+

Yes. Polish police confirmed that the three bodies found on the evening of 7 November 2026 in Ostrowiec Świętokrzyski were the attacker's father, aged 53, his mother, aged 52, and his sister, aged 21, all with gunshot wounds. Prosecutors opened a murder investigation covering these deaths.

Was Michał Oksiński a leftist or a right-winger?+

It is not established. The interior minister said preliminary findings pointed to far-right, ultranationalist sympathies, while old screenshots attributed to him show anti-clerical posts and other reporting cites a Falanga emblem on his clothing. Prosecutors say no confirmed extremist affiliation has been announced and the investigation continues.

Are the Facebook screenshots fake?+

Our detector found no sign the image was AI-generated, and the collage looks like real screenshots. The open question is whether the account belonged to him. Reporters describe the images as inconclusive and unverifiable, so they should not be treated as proof of his views.

Did the government delete his Facebook accounts?+

There is no evidence of that. The Facebook profile attributed to him could no longer be accessed after the attack, but platforms routinely remove the accounts of mass-shooting suspects, and reporters noted the account was not publicly reachable. No source links the removal to the government or police.

Why do old social-media posts matter in a case like this?+

They can help investigators understand a person's history, but they are not a reliable statement of an adult's beliefs, especially when the person was a teenager at the time. Attribution also has to be established: anyone can create an account in someone else's name.

Go deeper

Anarcho-communist
A person who supports a form of communism without a state, often associated with the far left.
Antifa
Short for anti-fascist; a loose movement of groups and individuals who oppose far-right ideology.
Falanga
A Polish national-radical group associated with the far right.
False context
When genuine content is shared with wrong information about where, when or by whom it was made.
Attribution
Establishing that a piece of content really comes from the person or source it is claimed to come from.

People also search for

Michał Oksiński lewak antifiarz anarchokomunistaOksiński wyśmiewał chrześcijaństwo zrzuty ekranu Facebookkto usunął konta zamachowca z Krakowa na FacebookuCzy zamachowiec z Krakowa był lewicowcem?Oksiński rodzice i siostra znalezieni martwi w mieszkaniu
For educators+
Misleading content and false context: how real elements can be arranged to imply a false conclusion.Attribution versus authenticity: a genuine screenshot can still be about the wrong person.The difference between a confirmed fact and an inference built on it.
  • The post contains a confirmed fact (the family deaths) and an unconfirmed conclusion (the cover-up). Why might a true detail make the rest of a post feel more credible?
  • The screenshots are from 2019-2021, when the attacker was 17-19. How much should teenage posts count as evidence of someone's adult views?
  • How would you check whether a social-media account really belongs to the person it names?

About this check

Platform
X
Posted by
@edgar_korona
Posted
November 7, 2026
Age when checked
1–2 days old when checked
Where it spread
PL
Audience
UK & EU audience
Language
PL
Status
● Post is live
Verified
November 9, 2026, 03:08 UTC
Published
November 9, 2026, 03:08 UTC

Reach. 564.8K views, 14.9K likes, 4.3K reposts; PAP lists AI-edited 'antifa badge' photo of attacker among top false narratives

This verdict was generated with AI from the sources shown. AI can make mistakes — check the sources before relying on it.

Check anything yourself, in seconds.

Share any social post or video to What the Fact and get the verdict, the confidence, and the receipts.

Download on theApp StoreGet it onGoogle Play