Coordinated inauthentic behavior is organized activity by multiple deceptive accounts that work together to mislead an audience. The accounts may look like real users, but they are managed to push the same narrative, amplify each other, or simulate genuine support and disagreement. The coordination can be visible in timing, repeated phrasing, shared infrastructure, or identical engagement patterns, even when the individual posts seem harmless.
In cyber security, this matters because influence operations are often an abuse-detection problem, not just a content-moderation problem. Attackers use coordinated accounts for disinformation, fraud, reputation manipulation, and social engineering, sometimes with automation to scale posting and persona management. Defenders look for synchronized activity, cross-account similarity, unusual login or device patterns, and rapid changes in messaging. Detecting the network behind the posts helps identify campaigns earlier and makes attribution, takedown, and containment more effective.