With Election Day on November 3, campaigns, reporters and election officials are reading the online conversation for signs of how voters feel, and that is where a coordinated attack can look like a groundswell. For governments facing a growing threat of election interference, defending public trust starts with knowing which voices are real. Cyabra’s 2026 U.S. Midterm research examined six of the most competitive Senate and governor races to separate coordinated inauthentic activity from genuine voter sentiment. The clearest pattern emerged in the place candidates, campaigns and reporters read most closely: the replies on candidates’ own X accounts.
- Cyabra identified coordinated inauthentic accounts in five of six races.
- In most races, between 1 in 5 and 1 in 3 replies on a candidate’s own X account came from inauthentic accounts, up to three times the overall rate.
- In four races, coordinated attacks hit both the Republican and the Democratic candidate.
- Activity peaked around the mid-October debates and was still active in Ohio and Michigan when the analysis window closed.
Inauthentic Accounts Concentrated Where Candidates and Reporters Read
Across the six races, about 1 in 9 posts about the candidates came from inauthentic accounts, at roughly the same rate for Republican and Democratic candidates. The share was about 1 in 4 on TikTok, 1 in 7 on X, 1 in 11 on Instagram and under 1 in 20 on Facebook.
The candidates’ own reply sections carried up to three times the overall rate: about 1 in 4 replies to both Georgia candidates, 1 in 3 on Kansas candidate Adam Hamilton’s personal account and about 3 in 10 on the Lombardo campaign’s account in Nevada.
Coordinated Bursts Peaked Around the Debates
In Georgia, the biggest spike came on debate night, 7 October, and in the race’s peak window more than half of active profiles were inauthentic. In Kansas, the operation opened by flooding Marshall’s X replies and returned to them in 7 of its 8 activity windows.
In Ohio and Michigan, coordinated activity was still under way when the analysis window closed on 19 October.
Coordinated Attacks Hit Both Parties in Four Races
In Ohio, Georgia, Maine and Kansas, coordinated attacks hit both the Republican and the Democratic candidate. In Maine, one operation amplified attacks on Susan Collins around the debate while another flooded Troy Jackson’s X replies with abuse. In Michigan, one operation pushed Muslim Brotherhood claims against Abdul El-Sayed while another promoted Mike Rogers.
Telling the two layers apart changes how a race reads. In Ohio, a “Vote Acton” wave that looks like crossover support is driven largely by identity-based opposition to Vivek Ramaswamy. In Nevada, inauthentic accounts posted hate speech more often than real accounts on every platform, 41% of their X posts against 21%, making the candidates’ replies look far more hostile than voters are.
Coordinated Accounts Rarely Post the Same Words
The accounts coordinated through timing and targets. They posted in synchronized bursts, pushed the same narratives across platforms and replied again and again to the same accounts, but rarely used the same words, which is why keyword-based monitoring misses them. Inauthentic X accounts were also much newer: 31% to 42% were created in 2025 or 2026, compared with 7% to 13% of real accounts.
Each race had its own operations. Inauthentic accounts appeared in more than one state at the same rate as real users, and what they repeated across races was generic: “vote blue,” “voting red across the board” and emoji captions.
The Real Risk: a Distorted Picture of the Electorate
Inauthentic accounts were a steady presence in every race, on both sides of the ballot. They gather where democratic signals get read: the replies candidates check, the threads reporters quote and the TikTok clips voters scroll. When a coordinated attack passes for a groundswell, the picture of what voters think tilts. Because the attacks hit candidates of both parties, the target is the democratic process itself.
For governments, that makes inauthentic activity an election integrity issue. Protecting elections depends on knowing what is authentic, whether activity is coordinated and, where the evidence allows, who is behind it, early enough to act before a manufactured narrative takes hold. As Cyabra CEO Dan Brahmy put it, public trust “is being shaped by forces most citizens can’t see.” For election officials and organizations alike, that starts with watching live moments such as debates, when coordinated activity peaked, and checking who is behind a surge of replies before reading it as public sentiment.
Download the full research: Coordinated Inauthentic Activity in the 2026 US Midterm Races. The full research compares all six races, with a deep dive into each state.
Contact Cyabra to see how election monitoring helps governments and election officials separate authentic voter sentiment from coordinated inauthentic activity.
