Foreign Influence Campaigns Targeting Israeli Elections Revealed

A comprehensive report by the Institute for National Security Studies (INSS) has exposed foreign influence operations by Iran, the Muslim Brotherhood-affiliated Isnad network, and Russia's "Doppelgänger" operation, all aiming to undermine trust in Israeli institutions and sow societal division ahead of the October 27th Knesset elections. The primary objective, according to the report's authors, is not to favor a specific party but to erode public confidence in state institutions, the electoral process, and societal cohesion. While no coordination between these actors regarding Israel was found, they all exploit existing internal disputes to exacerbate them.

The report, authored by David Siman-Tov, Danny Citrinowicz, Amit Cohen, Reut David, Dr. Githit Bar On, and Amit Sharon, is based on INSS monitoring of Isnad on X, documentation from FakeReporter, and research from Golden Owl, Alethea, and ClearSky. The researchers distinguish between direct election interference and the amplification of existing influence efforts, noting that most identified activity falls into the latter category. This long-term effort to damage public trust and social resilience predates the election period and is expected to continue afterward, with influencing voting patterns or determining outcomes considered a secondary goal, if at all.

Key issues exploited by these networks include the October 7th events, the Haredi draft, religion-state relations, foreign policy, and trust in leadership. The messages are tailored to various audiences, sometimes contradictory, but consistently convey suspicion and despair. The report highlights that while internal disputes are a legitimate part of democratic discourse, foreign adversaries posing as Israelis and injecting their messages into the discourse without transparency is the core problem. FakeReporter uncovered a notable example: a foreign profile named "Miriam Kozak," possibly Iranian, amassed over 20,000 followers and millions of post exposures, even operating a Facebook group that generated AI-created inflammatory content. This account was removed from X only recently following FakeReporter's intervention.

Iran's strategy, viewed as part of a broader campaign against Israel, aims to deepen internal divisions as a strategic advantage. By weakening national resilience and trust in leadership, Tehran seeks to limit Israel's decision-making flexibility. Iran doesn't need to favor a specific camp or create new disputes; amplifying existing ones is sufficient. A scenario where political camps refuse to accept election results and trust in institutions is eroded, regardless of the winner, would be a significant achievement for Iran. FakeReporter documented an Iran-linked network using an Iranian app store and location data pointing to Iran, disseminating polarizing content. Golden Owl identified numerous X accounts posing as Israelis, with about 150 linked to Iran based on location or app usage, some of which were initially activated during a 2025 military operation and repurposed for the elections.

The Russian "Doppelgänger" operation, attributed by the US and EU to Russia, was also active in October 2026 concerning Israeli elections, alongside activities targeting US and French elections. ClearSky reported a resurgence of campaign activity in Israel since August, focusing on perceived US distancing from Israel, potential conflict with Turkey, economic crises, and emigration. This renewed activity may be linked to influencing public opinion before the elections. Alethea found the operation used dozens of content-spreading accounts and over a thousand amplification accounts, including a website impersonating Walla! that published fabricated Hebrew articles. These contents focused on eroding trust in Israel-US relations, without direct engagement with Israeli parties or candidates, suggesting a broader Russian interest in bilateral ties.

The primary platform for these operations is X, with activity also noted on Facebook, Instagram, TikTok, and Telegram. Actors often operate across multiple platforms, using fake Israeli profiles with Hebrew names and stolen or AI-generated images. Some accounts were created shortly before the elections, while others were older accounts repurposed. The report warns of a potential combination of cyberattacks and influence operations, including the hacking and coordinated dissemination of sensitive information, which could further polarize society and undermine trust. The Israeli Internet Association is expanding its Safe Internet helpline to address voter deception, impersonation, and challenges to election results in real-time.