Iranian Influence Network Targeting Israeli Elections Exposed

An Iranian influence network, comprising at least 649 X (formerly Twitter) accounts posing as Israeli citizens, has been uncovered just weeks before Israeli elections. The network has been disseminating divisive and inflammatory narratives, including conspiracy theories about internal betrayal during the October 7th massacre, attacks on Prime Minister Benjamin Netanyahu, and claims of Iranian strength versus Israeli weakness. These messages and responses garnered millions of views and hundreds of thousands of interactions.

A report by Spanish cyber intelligence firm Golden Owl revealed that the network is prepared for the final stretch before the elections. The accounts are described as sufficiently old to appear legitimate, numerous enough to withstand suspensions, and well-connected to reach a genuine audience. Their messaging is framed for the post-election period, intending to portray any defeat of the "change bloc" as a deception and a defeat for Netanyahu as a victory over "betrayal." The network's objective is not to sway votes for specific parties but to deepen distrust in the electoral process itself.

Golden Owl analyzed over 560,000 data points, including 71,000 accounts, 138,000 relationships, and over a quarter-million posts between August 11 and October 11. The analysis identified a network of at least 649 fake accounts, with 445 confirmed with high or medium-high certainty as Iranian influence operations. During the analyzed period, these accounts published 13,400 posts and replies, accumulating 4.73 million views and 160,660 interactions.

The accounts operate from infrastructure linked to Iran, using VPNs in countries like Germany, the Netherlands, the US, and Finland. Many are designed to appear Israeli, using Hebrew names or posting primarily in Hebrew, with no indication of their Iranian origin. However, many are identified as operating directly from Iran or countries such as Nigeria, Pakistan, Turkey, Yemen, Saudi Arabia, and Benin. Evidence of a coordinated network includes word-for-word post duplication within minutes and patterns consistent with AI-generated content, including the appearance of Persian or Arabic characters within Hebrew posts.

The network leverages authentic Israeli users who unknowingly share the content, alongside a system of foreign accounts retweeting each other. The X algorithm's recommendation system, which considers engagement signals like replies and retweets, is exploited to amplify the content. This allows hundreds of accounts with few followers to inject narratives into established discourse and gain broad exposure with minimal operational investment. The network's activity was particularly noted during the initial phase of the war, with many accounts created simultaneously and posts using hashtags like "Bibi_Go" and "No_to_War."

Leading up to the elections, Golden Owl identified six key narratives promoted by the network in September: the October 7th events as "Netanyahu's Massacre," Qatari money, exemptions for the ultra-Orthodox from military service, a political survival struggle, Israel's collapse, and a countdown to October 27th. The overarching goal is to undermine Israeli public trust in the government, the military, the country's future, and the elections themselves, exploiting existing political and social divisions, especially concerning the war, leadership, security, hostages, and democratic institutions.