Detectives investigating an attack by a Tunisian man who killed three people in a Nice church have a second suspect in custody, as France heightens its security alert amid religious and geopolitical tensions around cartoons mocking the Muslim Prophet Muhammad.

Tunisian anti-terrorism authorities have opened an investigation into an online claim that the attack was staged by a previously unknown Tunisian extremist group.

Muslims held more anti-France protests across the Middle East and beyond on Friday, while mourners placed flowers, messages and candles at the entrance to the Notre Dame Basilica in the French Riviera city where Thursday’s knife attack took place.

The attacker, Ibrahim Issaoui, was seriously wounded by police and taken to hospital in life-threatening condition, authorities said. Anti-terrorism prosecutors in France and Tunisia are investigating.

The new suspect is a 47-year-old man believed to have been in contact with the attacker the night before the attack, according to a judicial official.

A substitute prosecutor at the Tunisian anti-terrorism prosecutor’s office, Mohsen Dali, told the Associated Press a claim of responsibility came in an online post saying the attack was staged by a group called Al Mehdi of Southern Tunisia, previously unknown to Tunisian authorities.

The victims included 55-year-old Vincent Loques, a father of two who was the church’s sacristan, in charge of its holy objects, according to local broadcaster France-Bleu.

Another was a 44-year-old mother of three from Brazil named Simone who had studied cooking in Nice and helped poor communities, France-Bleu said.

In an interview broadcast on Friday with Saudi-owned Al-Arabiya TV, the attacker’s mother said she was shocked by the events.

She said she was surprised to hear her son was in France and had no idea what he was planning. “You don’t know the French language, you don’t know anyone there, you’re going to live alone there, why, why did you go there?” she said she told him over the phone when he arrived.

His brother told Al-Arabiya that Issaoui had informed the family he would sleep in front of the church, and sent them a photograph showing him at the cathedral. “He didn’t tell me anything,” he said.

A neighbour said he knew the assailant when he was a mechanic and held various other odd jobs, and had shown no signs of radicalisation.

France’s anti-terrorism prosecutor said the suspect is a Tunisian born in 1999 who reached the Italian island of Lampedusa, a key landing point for migrants crossing in boats from North Africa, on September 20, and travelled to Bari, a port city in southern Italy, on October 9. It is not clear when he arrived in Nice.

Tunisians fleeing a virus-battered economy make up the largest contingent of migrants landing in Italy this year. Italian media reported that from Lampedusa, where Issaoui was one of 1,300 arriving migrants on September 20, he was placed with 800 others on a virus quarantine boat in Puglia.

After the two-week quarantine, he received a notice that he was being expelled from Italy for illegal entry and was given seven days to leave the country, according to Milan daily Corriere della Sera.

Italy’s interior minister confirmed the suspect was ordered to leave Italy on October 9. Luciana Lamorgese said he was not flagged by either Tunisian authorities or intelligence agencies.

The attack was the third in less than two months that French authorities have attributed to Muslim extremists, including the beheading of a teacher who had shown caricatures of the Prophet Muhammad in class after the images were re-published by satirical newspaper Charlie Hebdo.

The images deeply offended many Muslims, and protesters burned French flags, stomped on portraits of President Emmanuel Macron and called for boycotts of French products at demonstrations in Pakistan, India and Afghanistan.

Mr Macron said he would immediately increase the number of soldiers deployed to protect French schools and religious sites from around 3,000 to 7,000. Schools remain open during a nationwide lockdown that started on Friday to stem the spread of coronavirus, but religious services are cancelled.

Nice imam Otmane Aissaoui condemned the “terrible act of terror, of savagery, of human insanity that plunges us into sadness, shock and pain” which had again put French Muslims in the spotlight.

The attacker “hit brothers and sisters who were praying to their lord”, he told the Associated Press. “It’s as if a mosque was touched… I am deeply Christian today.”

Read more: Students helped killer find teacher who was beheaded, says French prosecutor

French leader decries terrorist attack against teacher