Allied Intelligence — 2026-10-17

Mossad Email Spoofing Prank Exposes Persistent Israeli Government Failure to Implement Basic Email Authentication Protections

BLUFMissing email authentication on mossad.gov.il lets any adversary forge official Israeli intelligence correspondence, and Israeli authorities are unlikely to confirm the incident or deploy protective records by November 17.

International Cyber Digest posted on October 12 that an email from a mossad.gov.il sender offered 47 of Netanyahu's toenail clippings to vx-underground for 8,000 shekels, and said the sender came from a compromised Israeli government domain 1. Haaretz reported that security researcher Noam Rotem received bizarre emails and warned of a possible Mossad breach 2. The secondary source's own DNS query on October 13 found no SPF or DMARC records for mossad.gov.il 1, and Haaretz's October 15 report said anyone can fake Israeli government emails despite nine years of warnings 3. The Mossad reportedly said the matter is "under review," and no source has published the full headers or confirmed unauthorized access 1.

Analysis
Israeli authorities or the Mossad are unlikely to publicly confirm spoofing or compromise, or to publish SPF/DMARC records for mossad.gov.il, by November 17. Confidence is moderate: one DNS check shows no records, the Mossad says only "under review," and no one has published headers or confirmed access. Sourcing is a narrow cluster, since Haaretz, which is paywalled, supplies the primary report and follow-up, and the secondary site mostly relays it. The emails may be a plain prank through forged headers, which would explain the missing records without any intrusion. Either way, anyone can forge the agency's address, and nine years of warnings went unheeded. With the October 27 election, recipients of Israeli government mail must treat sender addresses as unverified unless officials confirm the cause or publish the records.

3 sources

Mossad hacked? Email to vx-underground, domain has no SPF or DMARC - pasqualepillitteri.it
Security Researcher Warns of Possible Mossad Hack After Getting Bizarre Emails - Haaretz
Mossad prank shows anyone can fake Israeli government emails despite nine years of warnings - Haaretz