Adversary Intelligence — 2026-08-17

Shin Bet and Israel Cyber Directorate Warn Iranian Intelligence Operatives Targeting Israeli Journalists via WhatsApp and Telegram Phishing Campaign

BLUFTehran's persistent social-engineering campaign against Israeli journalists and security officials treats human trust as the primary attack surface, positioning Iran to harvest sources and correspondence that feed both espionage and influence operations.

Israel's Shin Bet security service and the National Cyber Directorate said Sunday that Iranian intelligence operatives have intensified a phishing campaign against Israeli journalists, contacting targets on WhatsApp and Telegram while posing as trusted contacts, including other journalists 123. According to the joint statement, the messages offer interviews or collaboration and direct victims to a fraudulent page designed to steal Google account credentials or to files that can compromise a phone 23. Reporters at Haaretz have been targeted among others 14. Shin Bet and the Cyber Directorate said the campaign also targets people in political, governmental and security roles, seeking journalists' sources, correspondence and sensitive material on Israel's political and security establishment 23.

Analysis
Iranian intelligence has broadened its social-engineering push against Israeli media beyond technical intrusion, extending targeting from journalists to political, governmental and security personnel who hold parallel access to sources, internal correspondence and details of Israel's security posture, information with direct utility for espionage, influence operations or physical targeting. The public warning itself functions as a countermeasure, alerting the exposed community before further compromises occur, though it may equally serve Israeli institutional interests by justifying expanded cyber directorate authority independent of the campaign's actual sophistication. Corroboration is broad but structurally shallow: an aggregator and separate English and French outlets echo a single joint Shin Bet-cyber directorate statement rather than independently sourced reporting, meaning confidence in the scale of compromise beyond the stated messaging pattern rests on one institutional account.
4 sources
  1. Shin Bet: Iranian Intel Trying to Hack Israeli Journalists' Phones and Accounts - Haaretz
  2. IRANIAN CYBER THREAT: Shin Bet Warns Journalists Of Targeted Phishing Campaign - The Yeshiva World
  3. Cyberattaques : l'Iran cible des journalistes israéliens via WhatsApp et Telegram - i24NEWS
  4. Haaretz and Israel National Cyber Directorate: Iranian Intel Trying to Hack Israeli Journalists - Rankiteo Blog

View in full brief →

UNCLASSIFIED // OPEN SOURCE