What Brands Get Wrong When They React to Online Attacks

This playbook is based on a session given on the main stage of the Meltwater Summit in NYC by Dan Brahmy, Co-founder and CEO of Cyabra, and Jonathan Rosen, CEO of Orchestra. The session was titled "JARVIS, what am I looking at? The First Question Brands Should Ask Before Responding Online."

The Landscape Has Changed. Your Playbook Needs To.

Communicators today are operating in a world defined by three forces pulling in the same direction at once.

People. Audiences are everywhere, consuming news from dozens of sources simultaneously. Your audience is not seeing one version of reality. They are seeing hundreds of versions across ten different platforms in real time.

Pace. AI has accelerated news cycles beyond anything seen before, demanding response times that most organizations are not built for.

Power. Threats to brands are now democratized. A single tweet, image, or video can go viral in hours. Anyone can start a storm.

Together, these three forces have made the old instincts unreliable. Moving fast without clarity is no longer a neutral choice. It is a risk.

How a Modern Influence Operation Actually Works

Fake online campaigns today are not what they used to be. The old model – bots talking to bots in an echo chamber – is largely obsolete. What Cyabra’s data shows now is fundamentally more sophisticated, and it follows a four-stage cycle.

Stage 1: A real conversation starts.
It begins with something genuine. A company changes its logo. An executive leaves. A campaign launches. Real people react because it is interesting or triggering.

Stage 2: Fake actors embed themselves.
Inauthentic profiles do not create the story from scratch. They find the existing real conversation and insert themselves into it, pushing new narratives from the inside.

Stage 3: Media accelerates the cycle.
Journalists see the viral activity and treat it as signal. One outlet picks it up, then two, then ten. This stage happens fast.

Stage 4: A new reality forms.
The narrative, now amplified by media, becomes accepted as fact. The loop closes and starts again.

As Dan Brahmy put it: “It’s never about the five or the 50,000 inauthentic profiles. It’s always about whether the minority has the ability to influence the majority.”

Case Study: Cracker Barrel

When Cracker Barrel changed its logo, real people were unhappy. That was a genuine reaction to a real business decision. But what happened next was not organic.

Fake actors saw the moment and moved in. They did not manufacture the story – they hijacked an existing one. Working across coordinated inauthentic profiles, they pushed three distinct narratives simultaneously:

1. Tradition vs. modern: The new logo erases the company’s heritage and 50 years of trust.
2. Financial doom: The rebrand signals financial trouble. Delete the app. Don’t go back.
3. The villain CEO: One person is responsible. Hold them accountable.

These three tracks, pushed by well-orchestrated inauthentic networks, reached 4.5 million people within a day and a half. Media took notice. Outlets reported on the backlash. Once mainstream media picked it up, it solidified as public reality. The company’s stock fell. Nearly $100 million was wiped out. Cracker Barrel reverted to the old logo within a week.

The inauthentic network did not directly cause the stock drop. But they were embedded deeply enough in real conversations to distort public perception at scale – and that distortion had real consequences.

The Blind Spot: What Your Current Tools Are Not Telling You

Monitoring and social listening platforms are essential and always will be. But there is a layer of questions that most monitoring solutions were not built to answer: Who is amplifying this? Who is trying to orchestrate what you are seeing? Is this pressure authentic, coordinated, or simply loud?

Reacting to manufactured noise as though it were real signals is one of the most expensive mistakes a brand can make.

The Playbook: Measure, Monitor, Manage

Step 1: Measure for signal instead of noise.

Social noise and real-world sentiment are not the same thing. Two recent examples show what happens when brands have the data to know the difference.

When Nike launched its Colin Kaepernick campaign, bot traffic was off the charts and the stock dipped. But Nike’s communications team had first-party data. They saw what was really happening, held their position, and the shoe became a bestseller.

Earlier in 2025, American Eagle faced a massive wave of bot-driven backlash over a jeans campaign. They did nothing. They would not get baited. A few weeks later, they announced record-breaking sales and a rising stock price. As Jonathan Rosen put it: “They showed and didn’t tell. That takes a lot of guts.”

Both companies had a modern communications research function that let data, not noise, drive strategy.

Step 2: Monitor with a research mindset.

Real-time intelligence should answer three questions:

• Is this activity authentic or inauthentic? Get the proof quickly.
• Who is motivated to do this? Political group, commercial competitor, shareholder activist?
• Are the same accounts attacking this brand while boosting a competitor?

The goal is to move from defense to offense – from reacting to being able to provide your own first-party account of what is actually happening and why.

Step 3: Manage across your entire organization.

“Comms isn’t a marathon anymore,” Jonathan Rosen said. “It’s a decathlon.”

A communications problem today cannot be solved with a press release. It requires simultaneous, coordinated action across every part of the organization:

• HR & Internal Comms: Arm employees with accurate information in real time.
• Customer Experience: Ensure frontline and support teams know how to respond.
• Social Media: Unified voice, closely coordinated with comms.
• Influencer Partners: Give them the facts before the fake profiles get to them.
• Leadership: an organic video from the CEO, board alignment, clear internal messaging.

The old crisis rule of “less is more” no longer applies. We are in an attention economy. It takes an average of seven exposures to a message before it registers. One statement on your website is not enough. You need volume, across every community, simultaneously.

Responding with Clarity, Not Speed

The threats are not going away. Fake campaigns, coordinated inauthentic activity, and AI-generated content are getting cheaper, faster, and more accessible. Creating a convincing fake video review of a brand today takes five minutes and one prompt.

The brands that will come out ahead are not the ones that react fastest. They are the ones who know what they are looking at before they act. Before you respond to the next spike in your dashboard, ask yourself: is this real? Is this coordinated? And is reacting what the people behind this actually want you to do?

That clarity, before the response and not after, is what separates a brand that weathers a storm from one that hands the story to its attackers.

____

Watch the full session by Dan Brahmy and Jonathan Rosen: 

 

_____

About our partner, Orchestra:

Orchestra is a strategic communications and marketing company built for today’s complex and fragmented world. From decoding audiences to designing bold strategies, Orchestra integrates people, platforms and stories that stick to help clients build lasting influence. The company combines executive advisory, strategy development and tactical execution across channels – grounded in deep insight and analytics, delivered with urgency and optimized for impact. With 700+ experts across consumer and lifestyle, technology, nonprofit and philanthropy, real estate, sports, travel, hospitality and more, Orchestra helps organizations navigate change, seize opportunities and thrive.