Iran's Election Influence Network in Israel Exposed by Cyber Firm

An Iranian network of hundreds of fake social media accounts and thousands of posts aimed at influencing Israeli elections has been uncovered less than two weeks before the scheduled October 27 vote. A report by Spanish cybersecurity firm Golden Owl, released Tuesday, October 13, detailed the operation on the X platform (formerly Twitter).

The network, posing as Israeli users, disseminated provocative content designed to sow discord and division within Israeli society. Narratives included conspiracy theories about betrayal during the October 7 attacks and criticism of Prime Minister Benjamin Netanyahu, alongside claims of Iranian strength versus Israeli weakness. These posts garnered millions of views and hundreds of thousands of shares.

According to the report, the network was prepared for a final push before the elections, with accounts created long enough to appear legitimate and numerous enough to withstand suspensions. Their messaging was reportedly pre-written for the day after the election, intending to frame any outcome as fraudulent or a betrayal, thereby undermining trust in the electoral process itself rather than promoting specific parties.

Golden Owl analyzed over 560,000 data points, including 71,000 accounts, 138,000 connections, and over 250,000 posts between August 11 and October 11. The analysis identified at least 649 fake accounts, with 445 confidently identified as Iranian influence operations. These accounts published 13,400 posts and comments, achieving 4.73 million views, 124,490 likes, and 20,660 reposts.

The accounts operated through infrastructure linked to Iran, using VPNs in countries like Germany, the Netherlands, the US, and Finland. Many accounts mimicked Israeli users with Hebrew names or locations, concealing their true origin. Experts noted that many accounts likely operated directly from Iran or countries such as Nigeria, Pakistan, Turkey, Yemen, Saudi Arabia, and Benin. Evidence of a single network included identical posts copied across accounts within minutes, AI-generated text patterns, and unusual characters from Persian or Arabic keyboards in Hebrew posts.

The network amplified its reach by leveraging real Israeli users who unknowingly shared the content, as well as through a web of foreign accounts cross-posting each other. The report highlighted that the X algorithm, which considers comments and reposts for content ranking, was manipulated to enhance the network's visibility. This strategy allowed hundreds of low-follower accounts to inject narratives into public discourse, gaining significant reach through influential accounts and algorithmic recommendations at low operational cost.

Activity from these accounts was also observed during the first war with Iran, with 243 accounts created simultaneously on the fifth day of the conflict, posting hashtags like #Bibi_GoHome and #No_to_War. The posts often adopted a first-person perspective, simulating personal accounts of loss, fear, and regret about living in Israel, with some citing fabricated information from within the Shin Bet security agency about Israel's impending end.

Golden Owl stated the network's primary goal was not to sway votes for specific parties but to erode Israeli voters' trust in the government, military, the country's future, and the election process itself. The operation exploited existing political and social divisions, particularly concerning the war, leadership, security, hostages, and democratic institutions, to deepen societal rifts and undermine public confidence.