Topic starter
11/11/2026 6:04 pm
TL;DR: AI-generated deepfakes and inauthentic accounts were used to coordinate war narratives across major social platforms, according to Cyabra. Social platforms now need coordination analysis, not just content removal, because synthetic media can scale faster than normal moderation workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Cyabra: “How Iran Used AI to Fight a War Online”.
By the numbers:
- Cyabra identified a coordinated influence campaign generating over 145 million views across X, Facebook, Instagram and TikTok in under two weeks.
- 19% of accounts analyzed were inauthentic, amplifying AI-generated deepfakes and fabricated war footage at scale.
- TikTok was the source of 72% of total campaign views, delivering over 105 million views.
Key questions
Q: Why do coordinated fake accounts matter in disinformation campaigns?
A: Coordinated fake accounts matter because they simulate broad agreement, inflate reach, and make a false claim look locally popular or organically shared.
Q: How can analysts detect coordinated posting patterns?
A: Analysts detect coordinated posting patterns by correlating timestamps, account creation dates, IP ranges, device fingerprints, content similarity and shared links across many accounts.
Q: How do deepfakes change influence operations?
A: Deepfakes let influence operators fabricate audio, video, or images that appear to show a real person saying or doing something they did not, making false narratives more convincing and harder to rebut.
Practitioner guidance
- Harden account trust scoring Weight account age, posting cadence, language shifts, content reuse and burst timing into a single trust score for suspicious clusters.
- Correlate amplification across platforms Track whether the same narratives, hashtags and media assets appear together on multiple platforms within a short time window.
- Flag synthetic media markers Look for prompt artefacts, repeated staging, reused templates and near-identical captions as indicators of AI-generated campaign content.
Bottom line: The core risk is coordinated narrative manipulation, not just the presence of false media.
Glossary terms: Deepfake, Inauthentic Account, Coordinated Influence Operation, Platform Amplification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Influence operations now behave like distributed identity fraud: the core security issue is not only false content, but false actors acting in concert. Once inauthentic accounts can be created, reused and synchronized at scale, moderation becomes a downstream response to an upstream trust failure. The practical conclusion is that account integrity and behavioural correlation must become first-class controls in trust and safety programmes.
A question worth separating out:
Q: Can social platforms stop AI-generated influence campaigns?
A: Social platforms can reduce AI-generated influence campaigns with content provenance, bot and sockpuppet detection, rate limits, behavioural analytics, and moderation workflows, but they cannot stop every campaign. Operators can reuse accounts, vary outputs, and shift channels, so detection and takedown are usually partial and reactive.
👉 Read our full editorial: AI deepfakes and fake accounts shaped war narratives at scale