Coordinated inauthentic behavior, a term popularised by platform trust-and-safety teams, describes groups of accounts that work together while misrepresenting who they are, in order to manipulate discussion. The key is the combination: not just fake accounts, and not just coordination, but coordinated action that hides its true origin. It covers influence operations, spam networks, and campaigns that use sock puppet accounts to fake grassroots support.
For investigators, detecting CIB means looking past the content of individual posts to the patterns across accounts: synchronised posting times, shared phrasing, recycled profile photos, or clusters that were all created on the same day. It is a central concept in tracking disinformation, because identifying the network behind a message often matters more than debunking any single post.