Shin Bet exposes Iranian cyber espionage targeting Israeli hostage families

Iran is using fake online profiles to gather intelligence in Israel, the Shin Bet (Israel Security Agency) reported Monday.

Among its tactics are operations to photograph the homes of security personnel and public figures who oppose Iran in the media, it said. Public demonstrations for the hostages’ return are used as a platform to photograph participants, it added.

Iranian operatives are also targeting the families of hostages via fake expressions of grief, such as sending bouquets and messages to the families’ homes, the Shin Bet said. Other means of intelligence-gathering include fake survey prompts and volunteer forms that are used to gather information about personal details and skill sets, it said.

According to the Shin Bet, Iranian intelligence has used these online platforms to gather information:

Tears of the War spreads “disinformation and incitement” and is presented as a tool to recruit Israelis for activism on behalf of hostages, along with fake job postings.

Here+ poses as a research and survey platform, using a logo that appears to be based on that of Israel’s Channel 11. The platform is believed to use phishing to collect personal details of Israelis.

BringHomeNow is active mostly on Telegram, posing as a movement for the return of the hostages, using false volunteer forms to collect Israelis’ personal information.

Several other fake platforms purport to align with different political movements and are designed to deepen divides in Israeli society, the Shin Bet said.

Israeli organization 'Fake Reporter' responds

FakeReporter is an Israeli watchdog organization that exposes false reporting, bots, and similar activities online. Since the start of the war with Hamas, the organization claims to have exposed several foreign influence networks that attempt to employ Israelis, with violence at the center of their goal.

In response to the Shin Bet report, FakeReporter said: “We have been warning for a long time that the online ‘borders’ have been breached. These latest reports prove that the ‘fences’ have been breached on the Internet for a long time and that the enemies have settled among us.”

The state is “not doing enough to protect the public within virtual borders,” it said.

FakeReporter also called for a national plan for online safety that would allow Israelis to report online attacks in a similar way to how they report in-person attacks.