Cyabra’s analysis of six of the most competitive 2026 midterm races found coordinated inauthentic accounts working inside the candidates’ own reply sections. In three races, at least 1 in 4 replies on a candidate’s X account came from inauthentic accounts, reaching 1 in 3 on Kansas candidate Adam Hamilton’s personal account. Reply sections are where voters, journalists and campaigns read public sentiment, which makes them a direct target for election interference.
The activity surged around debates and peak news days. In Georgia’s peak window, more than half of all authors were inauthentic. In Ohio and Michigan, the operations were still active when the scan closed.
In four races, operations attacked both candidates at once. In Michigan, one pushed Muslim Brotherhood claims against El-Sayed while another promoted Rogers. The report compares all six races and includes a deep dive into each state, showing which attacks were manufactured and which came from real accounts.
Coordination indicators include synchronized bursts, shared narratives and repeated replies to the same targets, with almost no copy-paste between accounts, which is why keyword tools miss them.
Sony's decision to phase out physical PlayStation discs activated a pre-organized movement, attracted coordinated inauthentic amplification, and generated over 100 million views before the brand had responded.
Cyabra's analysis found a coordinated network of inauthentic accounts amplifying election fraud claims following a ballot paper shortage during South Korea's June 3 elections.
Cyabra's analysis of the boycott targeting five major U.S. retailers found inauthentic accounts padding volume and hopping between brands, without manufacturing the underlying anger.
