Foreign Influence Operations Targeting Israeli Elections Revealed

A comprehensive report by the Institute for National Security Studies (INSS) details foreign influence operations by Iran, the Muslim Brotherhood-affiliated ISNAD network, and Russia's "Doppelgänger" operation aimed at the upcoming Israeli elections. The primary objectives are to erode public trust in institutions, exacerbate societal divisions, and foster despair, rather than to favor a specific political party. Researchers found no evidence of coordination between these actors in the Israeli context, but all exploit existing disputes to intensify them.

The report, authored by David Siman-Tov, Dani Sitrinovitz, Amit Cohen, Reut David, Dr. Gittit Bar On, and Amit Sharon, is based on INSS monitoring of ISNAD on X (formerly Twitter), documentation from FakeReporter, and research from Golden Owl, Alethea, and ClearSky. The INSS researchers distinguish between direct election interference and the exploitation of the election period to amplify existing influence efforts. Most identified activity falls into the latter category, aiming for long-term damage to public trust and social resilience by leveraging heightened political discourse and deepening societal rifts. This effort predates the election campaign and is expected to continue afterward, with influencing voting patterns or determining outcomes considered secondary goals, if at all.

Key topics exploited by these networks include the October 7th events, the conscription of the ultra-Orthodox, religion-state relations, foreign policy, and trust in leadership. The messages target diverse audiences, sometimes contradicting each other, but consistently convey suspicion and despair. The report emphasizes that while internal disagreements are a legitimate part of democratic discourse, foreign adversaries impersonating Israelis and injecting their messages into the public conversation without disclosure is problematic. FakeReporter highlighted a significant infiltration case: a foreign profile, "Miriam Kozak," possibly Iranian, amassed over 20,000 followers and millions of post exposures on X, even operating a Facebook group that promoted AI-generated inflammatory content. This account was removed from X only recently following FakeReporter's intervention.

Iran's objective is to deepen internal divisions as a strategic gain, viewing societal fragmentation as a means to erode national resilience and trust in leadership. A divided society, the report suggests, struggles to agree on threats and the costs of confronting them, hindering public and political support for military action and narrowing decision-makers' maneuvering space. Iran benefits from a situation where political camps question election legitimacy and trust in institutions erodes, regardless of the winner. FakeReporter documented an Iran-linked network whose accounts connect through an Iranian app store and whose location data points to Iran, disseminating polarizing content. Golden Owl described a network of X accounts posing as Israelis, with about 150 linked to Iran based on location or app usage, some of which were activated during a previous military operation and repurposed for the elections.

The Russian "Doppelgänger" operation, attributed by the US and EU to Russia, was active in October 2026 targeting Israeli elections alongside US and French elections. ClearSky reported a resurgence of campaign activity in Israel since August, focusing on US distancing from Israel, potential conflict with Turkey, economic crises, and emigration. This renewed activity may aim to influence public opinion ahead of the elections. The operation utilized dozens of accounts to spread content and over a thousand to amplify it, including a website impersonating Walla! that published fabricated Hebrew articles. The content focused on eroding trust in Israel-US relations, without direct engagement with Israeli parties or candidates, suggesting a broader Russian interest in bilateral ties.

The primary platform for these operations is X, with activity also noted on Facebook, Instagram, TikTok, and Telegram. Actors often operate across multiple platforms, sharing content. On X, they engage in existing conversations around politicians and journalists, using stolen or AI-generated profile pictures and Hebrew names. Some accounts were recently created, while others were repurposed. The report warns of a potential combination of cyberattacks and influence operations, including the release of real, fake, or manipulated sensitive documents, which could deepen polarization and undermine trust, especially between election day and the final results. The Israeli Internet Association is expanding its Safe Internet hotline to address voter deception, impersonation, and challenges to election results in real-time.