Israel Ranks Second Globally in Cyberattacks, Microsoft Report Reveals

Israel ranked second worldwide in cyberattack frequency during the first half of 2026, with the United States leading, according to Microsoft's annual Digital Defense report released on October 1. Israel accounted for 7.6% of global hacker activity tracked by Microsoft, compared to 25.5% for the U.S. Ukraine and Taiwan followed with 4.8% and 3.9% respectively. Within the Middle East and Africa region, Israel was the most targeted country.

The report also highlighted that Iran is the primary source of cyberattacks against Israel, directing 39% of its global attacks towards the country. Iran also targeted the U.S. with 23% of its attacks and the UAE with 9%. Iranian-linked hacker groups have been conducting extensive operations against Israel and other Middle Eastern nations, while also significantly increasing their attacks on the U.S. and its interests. These groups are increasingly merging cyber warfare with physical military actions and social media influence campaigns, employing tactics such as data deletion and attacks on operational technology systems. Microsoft observed ongoing attempts at system infiltration for espionage and to enable future disruptions.

Cyber fraud incidents targeting Israel rose by 21% in the first half of 2026 compared to the same period in 2025. Microsoft views this trend within the context of cyber warfare driven by geopolitical objectives. Iranian groups are focusing on sectors of strategic and intelligence value, with research and academic institutions (28%), the IT sector (12%), transportation (11%), and government entities (8%) being common targets. Think tanks and NGOs also represented 8% of attacked entities.

Initial infiltration methods commonly involve exploiting known vulnerabilities, weak user authentication, and internet-accessible systems, primarily through credential theft and phishing. Attackers are leveraging cloud infrastructure for persistent access. Over 99% of observed initial cloud intrusions were attributed to brute-force password attacks against numerous accounts. Microsoft noted a convergence in tactics among various Iranian groups, enabling larger-scale and more impactful attacks. The report also pointed to the growing use of artificial intelligence (AI) to accelerate and broaden attacks, with AI agents themselves becoming targets requiring enhanced security measures.

Microsoft advises organizations to move beyond simply blocking malware, emphasizing continuous account protection, stronger authentication, rapid detection of unusual activity, and reduced threat response times. The report also warned that the impact of breaches can cascade through supply chains, affecting multiple organizations through compromised internet providers, accounts, or development platforms.

Yossi Karadi, Head of the National Cyber Directorate, stated that maintaining national operations amidst these threats is a collaborative effort involving the directorate, security forces, ministries, businesses, the cyber industry, and international partners. "In cyberspace, perhaps there are no visible rockets in the air, but there is no ceasefire," Karadi remarked, emphasizing the round-the-clock nature of cyber defense and the absence of absolute invulnerability. He added that AI is accelerating attacks, and successful defense often goes unnoticed, manifesting as averted breaches and continued daily life.