Hundreds of targeted Iranian cyber attacks against Israelis have been prevented, Shin Bet and Israel's Cyber Directorate say

Iranian regime-linked groups have been increasingly targeting Israeli citizens in cyber attacks over the last year, Israeli security agencies warned on Wednesday. 

The Israel Security Agency (ISA), commonly referred to as Shin Bet, and the National Cyber Directorate issued a joint statement warning of a significant increase in attempts by Iranian intelligence officials to hack into the private accounts of senior officials and citizens in Israel. 

According to the announcement, cyber attacks increased significantly in recent months following Operation Rising Lion. Security officials identified multiple attempts to infiltrate Google accounts and messaging apps, including Telegram, Signal and WhatsApp. The targeted individuals were public figures in Israel, including senior officials in the government, the defense establishment, academia, the media, and other citizens. 

The purpose of the hacking attempts is “to collect personal and professional information that can be used for terrorism, espionage, and influence activities, through a targeted phishing scheme,” Shin Bet and Cyber Directorate warned in the statement. 

While many of the messages were written in English, some targets also received messages in Hebrew. 

According to the security bodies, the methods used include “personalized approaches tailored to the target’s fields of interest, impersonating a familiar figure and inviting them to a meeting or to download files via a link, as well as ‘phishing impersonation’ messages aimed at obtaining the target’s login details, with emphasis on the password and even the additional verification code for the Google, Telegram, or WhatsApp account, thus granting the attacker full access to these accounts.” 

Earlier this year, some Israelis received text messages directly asking them to cooperate with Iranian intelligence. 

גל תחושות קנאה וקיפוח בקרב מי שלא קיבלו את המסר שהגיע הבוקר לישראלים רבים מ״סוכנויות מודיעין איראניות״ ולפיכך אינם נחשבים לסגל א׳, או לפחות ב׳ כמו בנט. חיוג למספרו של השולח מניב הודעה מוקלטת, סתמית, באנגלית. pic.twitter.com/xymUZwbKyj

— אמיר אורן - Amir Oren (@Rimanero) December 18, 2025

Security agencies said they have thwarted several hundred such attempts in recent months. These efforts included issuing targeted threat alerts, providing briefings on security checks to detect breaches, blocking and removing unauthorized account access, and advising on strengthening account protections and personal security.

At the same time, the agencies carried out campaigns to raise awareness of the threat and provide various tools.

Recently, the Iranian group "Handala" claimed responsibility for hacking into the devices of Israeli political figures such as Ayelet Shaked, former Prime Minister Naftali Bennett and the prime minister's chief of staff, Tzachi Braverman, publishing material from their personal devices.

While the exact method remains unknown, Bennett’s later claim that only his Telegram account – and not the device itself – was compromised suggests the attack may have been a phishing attempt similar to those described by Shin Bet and the Cyber Directorate.