Iranian Regime Critics Linked to Netanyahu Campaign

Online accounts previously associated with an influence campaign against Iran are now promoting Israeli Prime Minister Benjamin Netanyahu and attacking his political rivals ahead of the Knesset elections. These accounts are suspected of using fake networks to amplify Netanyahu's campaign propaganda and create an illusion of widespread public support on social media.

According to an investigation by the newspaper Haaretz, dozens of accounts that previously promoted Reza Pahlavi, the son of the former Shah of Iran, as an alternative to the Iranian regime, are now reposting Netanyahu's campaign clips and criticizing his opponents, primarily on the X platform. An analysis by the company Expoz revealed that approximately 1,600 accounts involved in promoting Pahlavi last year had 185 of them interact with Netanyahu's accounts since the official election period began on July 27. The report indicated that 264 accounts contributed to reposting his content.

Ten accounts participated in promoting posts targeting Gadi Eisenkot, head of the Yamina party, including a clip where Netanyahu falsely claims his rival would form a government with Yair Golan, Avigdor Lieberman, and Arab parties, and another accusing Eisenkot of opposing the assassination of Hassan Nasrallah. The accounts also promoted Netanyahu's attacks on Golan and military and security leaders. Some accounts went beyond reposting to direct commentary, with one writing, "Thank you Bibi, king," while another posted an AI-generated image with the phrase "Netanyahu 2026: Strong Leadership, Strong Israel." An account posing as an Iranian identity called opposition leader Yair Lapid a "traitor" in response to a post by conservative American journalist Mark Levin criticizing Lapid.

The suspicious accounts are linked to two networks previously exposed by Haaretz and TheMarker last year as part of online campaigns aimed at promoting regime change in Iran. A previous investigation showed one network was operated from Israel by a private entity that received government funding and employed Persian speakers. Researchers monitored the second network's accounts posting information about explosions near Evin Prison in Tehran before local media, following an Israeli attack in June 2025, and later circulating a fabricated video of the attack. Researchers at the time suggested a connection between the second network's activity and Israeli entities.

Further suspicion arose when an AI-generated clip posted by Netanyahu, showing a doctor treating what he described as the "obsession" of three Israeli journalists, garnered approximately 1.5 million views. According to an analysis by the company Scooper, about 5,000 accounts interacted with the clip, with only a third originating from Israel. A third of the non-Israeli accounts appeared to belong to users from Iran, despite the clip being in Hebrew and addressing an internal Israeli issue.

Suspicion also extended to Instagram, where accounts that previously posted messages in the name of Pahlavi's Iranian supporters began commenting in Hebrew on posts by Netanyahu and the Likud party. One such account commented on content posted by a right-wing Israeli influencer creating campaign videos in the Likud campaign's production company studios, using phrases like "Bibi, with you until victory" and "Only Likud, only Bibi."

This week, the Brandeis Institute and the organization V-Reported submitted a petition to the Central Elections Committee, attaching two assessments regarding the suspicious accounts. The Freedom of Information Movement had previously submitted a separate petition against Netanyahu and the Likud, accusing them of systematically using fake accounts and paid users to create a "false impression of popular support." The Likud denied any connection to the network and requested the petition be rejected. Central Elections Committee Chairman, Judge Noam Sohlberg, ordered Netanyahu, the Likud, Minister of Innovation Gila Gamliel, and the Prime Minister's Office to respond to the new petition by Thursday. Government and security officials denied any connection to the accounts, and Netanyahu's office denied any link. Gamliel responded, "This did not happen at all."