Disinformation Campaign Content

Coordinated disinformation campaigns use LLMs to generate the *fleet* of content that makes a false narrative look like an organic, broad-based movement: dozens of unique posts on one theme, bot-network messaging, multiple "angles" supporting the same lie, astroturfing materials, fake grassroots branding, sock-puppet backstories, and echo-chamber reinforcement. The technique works because perceived consensus is itself persuasive — people update toward views that appear widely and independently held. Historically, faking that breadth was bottlenecked by the cost of producing many distinct, fluent voices; LLMs remove the bottleneck, manufacturing persona-consistent diversity at scale and in any language.

• Coordinated inauthentic behavior (CIB) detection: Network-level analysis of co-timing, shared infrastructure, follower graphs, and content reuse
• Botnet/automation signals: Posting cadence, client fingerprints, and account-creation batches that indicate automation
• Stylometric and near-duplicate clustering: Detect a single generative fingerprint across many "independent" accounts despite paraphrase
• Account-age, velocity, and history forensics: Aged-then-activated or thin-history accounts converging on a narrative

Disinformation infrastructure is the distribution backbone for T8: it amplifies conspiracy material (T8-AT-003), spreads deepfake narratives (T8-AT-004), and carries election (T8-AT-011) and false-flag (T8-AT-010) payloads. " It chains with T1 prompt injection for bulk generation, with T9 synthetic media for visual payloads, and with T15 human-workflow exploitation when manufactured "public pressure" is aimed at decision-makers, journalists, or moderators.