Analysis |

Iran's Latest Effort to Recruit Spies Targets Israeli Weak Spot

Iranian tries to recruit spies didn't endanger Israel's national security, but Tehran seems to have identified a vulnerable underbelly to exploit in Israel's free internet

Amos Harel
Amos Harel
A protester punches his fist through an Israeli flag during a rally marking the annual Quds Day, or Jerusalem Day, on the last Friday of Ramadan in Tehran, April 29, 2022.
A protester punches his fist through an Israeli flag during a rally marking the annual Quds Day, or Jerusalem Day, on the last Friday of Ramadan in Tehran, April 29, 2022.Credit: Majid Asgaripour/WANA via REUTERS
Amos Harel
Amos Harel

There has been a significant rise in the number of Iranian attempts to strike at Israel through cyberattacks in the last year, both via direct attacks on infrastructure and websites and by online recruitment of spies and agents of influence. The announcement on Monday by the Shin Bet security service revealed an incident that came out in Israel’s favor – a thwarted Iranian attempt to use the internet to recruit Israeli citizens for terror attacks and espionage.

Who really calls the shots in Tehran? LISTEN to Israel's top Iran expert

Just four months earlier a similar attempt was also foiled with the arrest of a group of immigrants from Iran who had been recruited and received instructions over the internet from Tehran.

What the two incidents have in common is that they caused no harm to Israel’s national security, even if those arrested in the immigrant ring had made far more progress toward causing serious damage. Both incidents also reveal a similar modus operandi by Iranian intelligence: Its operatives deploy a very wide net in the hope that someone useful will eventually fall into it. A bit like the Nigerian sting artists we so often encounter on the internet, Iran is engaged in a kind of state-sponsored “phishing” to identify and operate naive targets as agents: Offers are sent to huge numbers of Israelis, and someone will be tempted to reply. Initially, the target isn’t aware that he or she will be acting against the state in the service of an enemy intelligence agency.

In this last case, the Iranians created an online profile (one time a woman, the previous time a man), and promised that in exchange for payment in cryptocurrency, the targeted Israelis were asked to gather intelligence and even undertake violent acts. If four months ago, the Shin Bet entered the picture only after the agents had been recruited, this time it intervened much earlier. The Iranians didn’t know that their fake profile was communicating with a profile no less fictive, behind which stood the Shin Bet.

Still, it seems that Iranian intelligence has identified a major point of weakness on our side: The Israeli internet is very democratic, and Israelis are happy to chat with almost anybody online. A lot of Israelis quickly realize who their interlocutor is and cut off contact the minute they get a concrete proposal to do something harmful. But the Iranians count on the few who continue to stay in touch either out of stupidity or greed. The continuing dialogue opens the door to manipulation and maybe eventually to their being activated.

Iranians prepare to set an Israeli flag on fire next to a picture of late Iranian general Qassem Soleimani during a rally marking Al-Quds (Jerusalem day) in Tehran, on April 29, 2022.Credit: AFP

That is what happened in the case of the immigrants (most of them female) who were arrested in the previous incident. Most of them were given small tasks, but on the internet everything happens very fast. You don’t even need a face-to-face meeting.

In the current case, according to the Shin Bet, the targets had already been asked to gather intelligence and then to harm various Israeli figures. We can assume that this won’t be the last attempt of this kind and that the Iranians won’t limit themselves to recruiting ordinary citizens but also people who can be of greater direct use to them.

Most of the blows exchanged by each side happen under the media radar. Nevertheless, only last week the international media reported that Israel had foiled an Iranian plan to assassinate an Israeli diplomat and American general in Europe, that there had been an air raid on an Iranian weapons convoy, and a rocket attack by a pro-Iranian Shi’ite militia on the city of Erbil in Iraqi Kurdistan, where Tehran has claimed in the past that Israel operates an intelligence base. All of this is happening in parallel with cyber warfare.

Given the alarming scale of the cyberwar phenomenon, the defense establishment may have to launch an information campaign warning Israelis of intelligence traps, as is sometimes done with online financial scams.

Click the alert icon to follow topics:



Automatic approval of subscriber comments.

Subscribe today and save 40%

Already signed up? LOG IN


Election ad featuring Yair Lapid in Rahat, the largest Arab city in Israel's Negev region.

This Bedouin City Could Decide Who Is Israel's Next Prime Minister

Dr. Claris Harbon in the neighborhood where she grew up in Ashdod.

A Women's Rights Lawyer Felt She Didn't Belong in Israel. So She Moved to Morocco

Mohammed 'Moha' Alshawamreh.

'It Was Real Shock to Move From a Little Muslim Village, to a Big Open World'

From the cover of 'Shmutz.'

'There Are Similarities Between the Hasidic Community and Pornography’

A scene from Netflix's "RRR."

‘RRR’: If Cocaine Were a Movie, It Would Look Like This

Prime Minister Yair Lapid.

Yair Lapid's Journey: From Late-night Host to Israel's Prime Minister