Analysis |

Iran's Latest Effort to Recruit Spies Targets Israeli Weak Spot

Iranian tries to recruit spies didn't endanger Israel's national security, but Tehran seems to have identified a vulnerable underbelly to exploit in Israel's free internet

Amos Harel
Amos Harel
Send in e-mailSend in e-mail
A protester punches his fist through an Israeli flag during a rally marking the annual Quds Day, or Jerusalem Day, on the last Friday of Ramadan in Tehran, April 29, 2022.
A protester punches his fist through an Israeli flag during a rally marking the annual Quds Day, or Jerusalem Day, on the last Friday of Ramadan in Tehran, April 29, 2022.Credit: Majid Asgaripour/WANA via REUTERS
Amos Harel
Amos Harel

There has been a significant rise in the number of Iranian attempts to strike at Israel through cyberattacks in the last year, both via direct attacks on infrastructure and websites and by online recruitment of spies and agents of influence. The announcement on Monday by the Shin Bet security service revealed an incident that came out in Israel’s favor – a thwarted Iranian attempt to use the internet to recruit Israeli citizens for terror attacks and espionage.

Who really calls the shots in Tehran? LISTEN to Israel's top Iran expert

Just four months earlier a similar attempt was also foiled with the arrest of a group of immigrants from Iran who had been recruited and received instructions over the internet from Tehran.

What the two incidents have in common is that they caused no harm to Israel’s national security, even if those arrested in the immigrant ring had made far more progress toward causing serious damage. Both incidents also reveal a similar modus operandi by Iranian intelligence: Its operatives deploy a very wide net in the hope that someone useful will eventually fall into it. A bit like the Nigerian sting artists we so often encounter on the internet, Iran is engaged in a kind of state-sponsored “phishing” to identify and operate naive targets as agents: Offers are sent to huge numbers of Israelis, and someone will be tempted to reply. Initially, the target isn’t aware that he or she will be acting against the state in the service of an enemy intelligence agency.

In this last case, the Iranians created an online profile (one time a woman, the previous time a man), and promised that in exchange for payment in cryptocurrency, the targeted Israelis were asked to gather intelligence and even undertake violent acts. If four months ago, the Shin Bet entered the picture only after the agents had been recruited, this time it intervened much earlier. The Iranians didn’t know that their fake profile was communicating with a profile no less fictive, behind which stood the Shin Bet.

Still, it seems that Iranian intelligence has identified a major point of weakness on our side: The Israeli internet is very democratic, and Israelis are happy to chat with almost anybody online. A lot of Israelis quickly realize who their interlocutor is and cut off contact the minute they get a concrete proposal to do something harmful. But the Iranians count on the few who continue to stay in touch either out of stupidity or greed. The continuing dialogue opens the door to manipulation and maybe eventually to their being activated.

Iranians prepare to set an Israeli flag on fire next to a picture of late Iranian general Qassem Soleimani during a rally marking Al-Quds (Jerusalem day) in Tehran, on April 29, 2022.Credit: AFP

That is what happened in the case of the immigrants (most of them female) who were arrested in the previous incident. Most of them were given small tasks, but on the internet everything happens very fast. You don’t even need a face-to-face meeting.

In the current case, according to the Shin Bet, the targets had already been asked to gather intelligence and then to harm various Israeli figures. We can assume that this won’t be the last attempt of this kind and that the Iranians won’t limit themselves to recruiting ordinary citizens but also people who can be of greater direct use to them.

Most of the blows exchanged by each side happen under the media radar. Nevertheless, only last week the international media reported that Israel had foiled an Iranian plan to assassinate an Israeli diplomat and American general in Europe, that there had been an air raid on an Iranian weapons convoy, and a rocket attack by a pro-Iranian Shi’ite militia on the city of Erbil in Iraqi Kurdistan, where Tehran has claimed in the past that Israel operates an intelligence base. All of this is happening in parallel with cyber warfare.

Given the alarming scale of the cyberwar phenomenon, the defense establishment may have to launch an information campaign warning Israelis of intelligence traps, as is sometimes done with online financial scams.

Click the alert icon to follow topics:



Automatic approval of subscriber comments.

Subscribe today and save 40%

Already signed up? LOG IN


Trump and Netanyahu at the White House in Washington, in 2020.

Three Years Later, Israelis Find Out What Trump Really Thought of Netanyahu

German soldier.

The Rival Jewish Spies Who Almost Changed the Course of WWII

Rio. Not all Jewish men wear black hats.

What Does a Jew Look Like? The Brits Don't Seem to Know

Galon. “I’m coming to accomplish a specific mission: to increase Meretz’s strength and ensure that the party will not tread water around the electoral threshold. If Meretz will be large enough, it will be the basis for a Jewish-Arab partnership.” Daniel Tchetchik

'I Have No Illusions About Ending the Occupation, but the Government Needs the Left'

Soldiers using warfare devices made by the Israeli defense electronics company Elbit Systems.

Russia-Ukraine War Catapults Israeli Arms Industry to Global Stage

Flame and smoke rise during an Israeli air strike, amid Israel-Gaza fighting, in Gaza City August 6, 2022.

Israel Should End Gaza Operation Now, if It Can