TL;DR: AI-generated deepfakes, inauthentic accounts and synchronized posting were used to push competing war narratives across major social platforms, according to Cyabra, producing over 145 million views and 19% inauthentic participation in analysed discourse. The pattern shows that perception management now depends on attribution, coordination analysis and rapid response, not content moderation alone.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cyabra's report: AI-generated deepfakes and inauthentic accounts were used to coordinate war narratives at scale across major social platforms.
Why it matters: This matters because influence operations now depend on synthetic media, account coordination and platform amplification, which changes how trust, moderation and threat attribution must be handled.
By the numbers:
- Cyabra identified a coordinated influence campaign generating over 145 million views across X, Facebook, Instagram and TikTok in under two weeks.
- 19% of accounts analyzed were inauthentic, amplifying AI-generated deepfakes and fabricated war footage at scale.
- TikTok was the source of 72% of total campaign views, delivering over 105 million views.
- Cyabra said 47 inauthentic accounts in the second wave generated over 40 million views.
Context
Coordinated influence operations use synthetic media, networked accounts and repeated narratives to manufacture consensus rather than persuade one viewer at a time. The control gap is not just content authenticity, but also the ability to detect orchestration across accounts, platforms and posting patterns.
Where AI-generated media can be produced and distributed quickly, the harder security problem becomes provenance and coordination, not simple moderation. That intersection matters for identity and trust because inauthentic accounts can behave like an access layer for propaganda, fraud and social engineering.
The pattern described here is typical of modern information operations, not an isolated burst of online noise.
Key questions
Q: How do deepfakes change influence operations?
A: Deepfakes let influence operators fabricate audio, video, or images that appear to show a real person saying or doing something they did not, making false narratives more convincing and harder to rebut. Defenders respond with provenance checks, media forensics, watermarking, and rapid verification against source material before content is amplified.
Q: Why do coordinated fake accounts matter in disinformation campaigns?
A: Coordinated fake accounts matter because they simulate broad agreement, inflate reach, and make a false claim look locally popular or organically shared. They also let operators test messages, evade moderation, and target different audiences with slightly varied versions while hiding the real source of the campaign.
Q: How can analysts detect coordinated posting patterns?
A: Analysts detect coordinated posting patterns by correlating timestamps, account creation dates, IP ranges, device fingerprints, content similarity and shared links across many accounts. Repeated bursts, near-duplicate wording, identical engagement timing and shared infrastructure often indicate automation or a coordinated influence operation rather than organic activity.
Q: Can social platforms stop AI-generated influence campaigns?
A: Social platforms can reduce AI-generated influence campaigns with content provenance, bot and sockpuppet detection, rate limits, behavioural analytics, and moderation workflows, but they cannot stop every campaign. Operators can reuse accounts, vary outputs, and shift channels, so detection and takedown are usually partial and reactive.
Technical breakdown
How coordinated posting reveals centralized influence production
Coordinated influence campaigns leave structural traces that organic discussion usually does not. Reused captions, fixed hashtag clusters, synchronized bursts and repeated visual templates are all indicators that content is being produced and distributed from a common playbook. In this case, the same narratives appeared across unrelated accounts and platforms, which suggests a directed operation rather than independent users converging on the same interpretation. Detection has to look across timing, text similarity, account age, language shifts and amplification patterns, because each signal alone can look ordinary. The analytical task is to identify orchestration, not just volume. See the Hack and Leak Operations Guide.
Practical implication: Build detections that score synchronized behaviour across accounts, posts and hashtags instead of relying on single-post moderation alone.
Why AI-generated deepfakes scale influence faster than review workflows
Deepfakes are synthetic audio or video assets designed to imitate real-world footage while pushing a specific narrative. Their operational advantage is speed and plausibility: once a convincing clip exists, many accounts can repost it with minor changes, making moderation and fact-checking arrive after the content has already spread. The article shows how prompts, reused staging and repeated visual motifs can act as forensic clues that a clip was generated, not captured. For defenders, the central issue is not whether a clip looks believable in isolation, but whether the surrounding distribution pattern matches a coordinated campaign.
Practical implication: Treat synthetic media as a distribution problem as much as a content problem, and investigate the surrounding posting network immediately.
Why inauthentic accounts behave like an identity control failure
An inauthentic account is not just a fake profile. It is a reusable identity primitive that can be used to seed narratives, amplify reach and simulate consensus. That makes this topic relevant to identity governance because the trust decision happens at account creation, not only at content review. When many accounts share prompts, timing or reuse patterns, the environment is effectively allowing identity fraud at platform scale. The governance lesson is that the integrity of the account layer determines whether downstream moderation can work at all.
Practical implication: Harden account trust checks and behaviour-based monitoring so platform identity integrity is assessed before amplification occurs.
Threat narrative
Attacker objective: The objective was to shape conflict perception by making one side appear stronger, the other side appear weaker, and the information environment appear organically aligned.
- Entry through inauthentic account networks and synthetic content production allowed the operation to seed narratives across multiple platforms at once.
- Credentialed access was not the main issue here; the abuse came from coordinated account behaviour, reused content and timing patterns that made the campaign look organic.
- Escalation occurred as the same deepfakes and captions were amplified through synchronized posting bursts, fixed hashtags and cross-platform repetition.
- Impact was narrative distortion at scale, with millions of views used to shape perceptions of military capability, losses and public sentiment.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Influence operations now behave like distributed identity fraud: the core security issue is not only false content, but false actors acting in concert. Once inauthentic accounts can be created, reused and synchronized at scale, moderation becomes a downstream response to an upstream trust failure. The practical conclusion is that account integrity and behavioural correlation must become first-class controls in trust and safety programmes.
AI-generated deepfakes have turned provenance into an operational control, not a media literacy problem: synthetic video is effective because it compresses creation time and multiplies reach before verification can catch up. That changes the balance between detection and response. Organisations need evidence trails, source attribution and cross-platform correlation, because content authenticity cannot be judged from the clip alone.
Coordination patterns are the named concept that matters here: repeated hashtags, synchronized bursts and reused prompts create a measurable pattern of orchestration that can be hunted. The article shows that the same framing can recur across separate events, which makes campaign continuity visible even when individual posts look ordinary. Decision makers should treat coordination analysis as a core analytic discipline, not an optional enrichment step.
Platforms and defenders need to separate narrative volume from narrative legitimacy: high view counts can be engineered, especially when short-form recommendation systems reward repetition and emotional content. That means a campaign can achieve operational success without broad public belief. The implication is that response plans must prioritize attribution confidence, cluster analysis and containment of amplification channels rather than raw post removal alone.
Identity and trust controls must now cover the social graph as well as the account ledger: AI platform account takeover is not the only identity problem in synthetic influence. The broader issue is whether an account, persona or posting cluster can be trusted to represent a genuine actor at the moment it is used to amplify content. Practitioners should define trust thresholds for account behaviour, not just account credentials.
What this signals
Coordination detection is becoming a trust control: as synthetic content gets cheaper to produce, the decisive signal shifts to how accounts behave together. Security and trust teams should expect more campaigns that are visible only when timing, reuse and amplification are analysed as a cluster, not as isolated events.
The practical threshold for response is moving earlier in the lifecycle. Once a narrative has been amplified by inauthentic accounts across multiple platforms, moderation becomes damage limitation, so the useful control point is the first burst of coordinated behaviour.
For practitioners
- Harden account trust scoring Weight account age, posting cadence, language shifts, content reuse and burst timing into a single trust score for suspicious clusters.
- Correlate amplification across platforms Track whether the same narratives, hashtags and media assets appear together on multiple platforms within a short time window.
- Flag synthetic media markers Look for prompt artefacts, repeated staging, reused templates and near-identical captions as indicators of AI-generated campaign content.
- Preserve evidence for attribution Capture timestamps, account graphs, repost chains and media hashes before removal so analysts can reconstruct the campaign structure.
- Tune response for coordinated clusters Escalate from post-level moderation to cluster-level containment when many accounts share the same narrative, format and schedule.
Key takeaways
- The core risk is coordinated narrative manipulation, not just the presence of false media.
- Cyabra's findings show that inauthentic accounts and synchronized posting can scale a campaign into tens of millions of views very quickly.
- Defenders need coordination analysis, provenance checks and cross-platform correlation to contain influence operations before amplification hardens into perceived truth.
Related NHI Mgmt Group resources: Hack and Leak Operations Guide · AI Agent Security Statistics · AI-Driven Account Takeover Guide · Autonomous AI Attack Agents
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0005; TA0007; TA0011 — Initial Access; Stealth; Discovery; Command and Control | The campaign relies on covert account behaviour, orchestration and concealment across platforms. |
| Recommendation — Map coordinated influence behaviour to ATT&CK and hunt for timing, reuse and cluster-based indicators. | ||
| NIST CSF 2.0 | DE.AE-02 — Anomalies and Events | Coordinated bursts and repeated narratives are anomalous patterns that require detection. |
| RS.AN-01 — Investigate Adverse Events | The operation requires investigation of cluster behaviour and campaign attribution. | |
| Recommendation — Tune anomaly detection to surface synchronized posting, repeated hashtags and cross-account reuse. Investigate suspicious narrative clusters as incidents, not isolated moderation cases. | ||
| NIST AI RMF | MAP — Map Context and Risks | Synthetic media campaigns require mapping of context, actors and harm pathways. |
| Recommendation — Map AI-generated influence risks to the actors, channels and harms they can create. | ||
| OWASP Agentic AI Top 10 | ASI09 — Human-Agent Trust Exploitation | The campaign exploits human trust in convincing synthetic media and false personas. |
| Recommendation — Treat synthetic content designed to exploit trust as a governed abuse pattern, not a content-only issue. | ||
Key terms
- Deepfake: Synthetic or altered media created with AI or machine learning so that a person appears to say or do something they never did. In security terms, deepfakes are trust attacks that can distort identity verification, approval workflows, and fraud detection.
- Inauthentic Account: An inauthentic account is an online account that pretends to be a genuine person, organisation, or audience member but is controlled deceptively or created for manipulation. Practitioners use the term for fake, impersonating, or coordinated accounts that distort trust, engagement, and attribution across platforms.
- Coordinated Influence Operation: A coordinated influence operation is a planned effort to shape opinion or behaviour by using multiple channels, messages, and accounts in a synchronised way. It often combines fake personas, amplified posting, and narrative repetition to make the activity appear organic while concealing a common controller.
- Platform Amplification: Platform amplification is the boosting of content reach by a platform's ranking, recommendation, sharing, or trending systems. It can spread posts far beyond their original audience, so manipulated, misleading, or coordinated content may gain visibility even without a large genuine following.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security programmes they run.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org