Just a few days before what many Israelis consider a crucial national election Oct. 27, Shin Bet, the Israeli domestic security agency, said a foreign influence campaign is targeting the election to sow division and weaken national resolve.
In consultation with the State Attorney’s Cyber Department and the Central Elections Committee, Shin Bet on Oct. 22 said it had identified and removed several social-media accounts that were trying to influence the Israeli election.
Shin Bet did not say which countries were behind these accounts, but Iran is the main suspect.
The tactics described track closely with what U.S. intelligence agencies documented in the 2020 U.S. presidential election, when they assessed with high confidence that Iran ran an influence campaign against President Donald Trump’s reelection. Israeli researchers say the goal this time is less to pick a winner than to deepen divisions inside Israel, and researchers warn the most sensitive window may come after polls close. Meanwhile, Iranian state-aligned media argue that no Israeli government would change course on Iran.
It’s unclear when any alleged interference started, but on July 27, Channel 13 reported that Shin Bet chief David Zini warned senior Israeli officials that Iran, Russia and China were trying to disrupt the election, and ranked interference as the agency’s second-biggest concern, behind only the threat of major terrorist attacks.
On Oct. 20, a week before the election, Ynet reported that Shin Bet had created a dedicated election-integrity team working with the Central Elections Committee and police. The agency called foreign influence, including cyber operations and social-media bots, a major threat to the vote and said it had already acted against it.
How it works
An Oct. 22 report by the Institute for National Security Studies (INSS) documents alleged Iran-linked activities aimed at meddling in the Israeli election.
According to the report, the social-media accounts do not look foreign. They write in Hebrew and present themselves as Israelis. Their profile pictures are either stolen or AI-generated.
Golden Owl, an open-source intelligence company referenced in the INSS report, identified a network on X.com.
According to Golden Owl, 157 profiles showed links to Iran. The identified accounts were either located inside Iran or using the Iranian version of the app.
One account had been posting comments in Persian until April 2026. After that, it started writing in Hebrew and pretending to be Israeli.
Many of the accounts, according to the report, did not have many followers. Instead, they posted comments under posts by politicians, journalists and large Israeli accounts.
The report describes this as “reply seeding.”
The messages do not necessarily point in one political direction.
A network documented in the report posted messages supporting the ultra-Orthodox (Haredi) campaign against military service while also attacking the ultra-Orthodox community.
According to INSS, the mixed messaging suggests the operation is not trying to advance a specific political position. Instead, it appears aimed at inflaming whichever divide is already there, in this case the fight over military service for the ultra-Orthodox. INSS also raised a second possibility: that the contradictory posts came from different networks that were not coordinating with each other.
Researchers also found efforts to contact political activists directly, including offers to make protest signs, run contests with prizes and ask people to document activities. In one case, they tried to reach journalists through a WhatsApp group. One Iran-linked profile offered to pay Israelis for work.
Based on the INSS assessment, Iran is trying to deepen divisions inside Israeli society and erode “the trust of the Israeli public and its social resilience over time,” which it would consider an achievement regardless of who wins.
For Iran, no difference
On Oct. 24, NourNews, an outlet affiliated with Iran’s Supreme National Security Council, wrote that despite differences between Israeli Prime Minister Benjamin Netanyahu and his rivals, the two camps generally agree on maintaining military superiority and a readiness to use force against Iran. Even if Netanyahu is defeated in the election, the outlet said, there would be no fundamental change in Israel’s position toward Iran.
Tasnim, a media outlet affiliated with Iran’s Islamic Revolutionary Guard Corps, which the U.S. State Department has designated a foreign terrorist organization, said leading rival Gadi Eisenkot’s differences with Netanyahu are more about tactics than about the use of military power against Iran.
History
Iran-linked activity around Israeli elections is not new. An earlier INSS and FakeReporter investigation documented suspected Iranian networks operating around Israel’s November 2022 election.
Before that election, researchers identified about 40 Twitter accounts urging a far-right politician to break away from his party’s joint slate, a split that could have left both sides without enough votes to win seats in parliament.
In the immediate run-up to the vote, hundreds of accounts, many posing as Israeli opponents of Netanyahu, posted coordinated messages asking Israelis to boycott the election. And after the election, several accounts across Facebook, Twitter, Instagram and Telegram spread allegations of election fraud, questioned the legitimacy of the result and called for protests.
After the 2020 U.S. election, the U.S. National Intelligence Council reported that the country’s intelligence agencies assessed that Iran carried out an influence campaign aimed at damaging Trump’s reelection prospects by using accounts that pretended to be members of the Proud Boys, a far-right group in the U.S., and sending threatening emails to voters. They also made a fake video claiming election fraud.
U.S. intelligence agencies did not find evidence that Iran or any other foreign actor tried to manipulate voting systems or the vote count, however.
Shortly before the 2024 elections, the U.S. Department of Justice accused three IRGC employees of trying to pass stolen material to journalists. The operation allegedly relied on fake identities and social engineering.
What’s next?
The INSS report warns of joint cyberattacks and influence operations. The period after the polls close could be especially sensitive, the report said.
INSS says influence networks could exploit technical problems, misleading videos or rumors of fraud to cast doubt on the election process once polls close Oct. 27, the same pattern researchers documented after Israel’s 2022 vote, when Iran-linked accounts spread fraud allegations and called for protests.
“In the eyes of the foreign actors, led by Iran,” the report concludes, “a reality in which political camps refuse to recognize the legitimacy of the election results, the political system is paralyzed and trust in institutions continues to erode, would be a greater achievement than any change in the distribution of mandates.”
