Foreign Actors Intensify Online Influence Operations Ahead of 2026 Israeli Elections

Hostile foreign actors, including Iran, Russia, and the Isnād network, are escalating their social media activities in Israel in anticipation of the October 27, 2026 Knesset elections. A comprehensive report by the Institute for National Security Studies (INSS) and FakeReporter reveals these entities are attempting to exploit existing societal divisions in Israel to deepen rifts and erode public trust in leadership and state institutions. The research, conducted by David Siman-Tov, Dani Sitrinovich, Amit Cohen, Reut David, and Amit Nachmani, monitored digital platforms with assistance from cybersecurity firms Xpoz, Golden Owl, Alethea, and ClearSky.

The primary goal of this foreign activity is not necessarily to sway election results for specific candidates or parties, but rather to leverage the election period to amplify existing influence efforts. The heightened public attention and political debates provide these actors with opportunities to disseminate controversial messages, exacerbate polarization, and undermine confidence in the democratic process. They are not creating new disputes but are capitalizing on existing tensions in Israel, such as the Haredi draft, religion-state relations, the failures of October 7, foreign relations, and trust in leadership, aiming to foster helplessness and portray Israel as being in an irreversible crisis.

Iran is identified as a key player, seeking to weaken Israel's national resilience by fostering division. Tehran believes a fractured Israeli society with low trust in its leadership would struggle to garner public support for a broad military campaign and would face reduced diplomatic maneuverability. Iranian activity includes spreading contradictory messages to different audiences, such as simultaneously supporting and condemning the Haredi draft protests, indicating a strategy to intensify existing conflicts rather than promote a consistent ideology. Researchers identified approximately 150 fake accounts on X linked to Iran, some established during the June 2025 "With All Our Might" operation, now repurposed for election-related activities. The report also raises concerns about potential integration of cyberattacks with the dissemination of stolen information, such as classified documents, to undermine election result legitimacy.

The Isnād network, an Islamist network associated with the Muslim Brotherhood and operating from Turkey, is also active. This network, reportedly led by an Egyptian opposition activist, uses volunteers and has been tracked through around 100 fake accounts posting extensively between August and October 2026. Their messages aim to undermine faith in Israel's future and encourage emigration, while also portraying the elections as rigged and pointless, thereby deepening despair and eroding trust in democratic influence.

Russia's Doppelgänger influence operation has also resumed activity in Israel, using a fake Israeli news website to publish fabricated articles in Hebrew. These articles focus on undermining trust in US-Israel relations, warning of economic crises, and raising fears of conflict with Turkey. However, most identified Russian distribution accounts were suspended by mid-October, with no direct activity against specific Israeli candidates noted.

Social media platforms like X, Facebook, Instagram, TikTok, and Telegram are central to these operations. Tactics include "reply seeding," where fake accounts comment on posts by influential figures to gain wider exposure, and "borrowed amplification," where genuine Israeli users inadvertently share foreign-originated content. The use of AI for creating profile pictures and text, and the repurposing of old foreign accounts into seemingly Israeli ones, are also noted. Beyond the digital realm, there are documented attempts, particularly by Iranian actors, to directly contact activists with job offers and to solicit coverage of political events, resembling covert recruitment efforts by hostile security entities.

Researchers warn of potential real-time disinformation campaigns on election day, using dormant fake accounts to spread misleading information. They also highlight the risk of exploiting vote-counting delays or malfunctions to spread unsubstantiated rumors of fraud. Partial videos or out-of-context information could be used to challenge the legitimacy of results and encourage political factions to reject them. The report advises the public to verify information sources, check account histories and profile pictures, be wary of suspicious language patterns, and exercise extreme caution with anonymous offers for tasks or information sharing.