Allied Intelligence — 2026-11-11

Shin Bet Investigates Iranian Operatives Who Planted Hundreds of Thousands of Threat Flyers Across Northern Tel Aviv

BLUFIran's ability to task operatives for a physical leaflet campaign inside Tel Aviv underscores a shift from cyber harassment to street-level influence operations that will pressure Shin Bet to dismantle recruitment and financing networks tied to Iranian intelligence.

Israel Police and the Shin Bet opened a joint investigation on Monday after residents of northern Tel Aviv found leaflets in mailboxes at several addresses, according to the Times of Israel 1 and Ynetnews 2. Police said each leaflet carries a QR code linking to a webpage with "threatening content," and Yarkon District officers collected evidence at the reported locations 12. Per the Times of Israel and Jerusalem Post, the Handala site, which police shared in a screenshot, warns that no power station, refinery or desalination plant will remain if Israel attacks Iranian energy infrastructure 13. Handala claimed on Telegram that "dozens" of its operatives delivered "hundreds of thousands" of leaflets overnight 12. Police have not confirmed that figure or the group's role, and JFeed reported that hundreds of mailboxes were filled in several buildings 4.

Analysis
The leaflet drop shows Iran-linked actors can reach Israeli civilians at their doors, which shifts the problem from network defense to domestic counterintelligence. The text links the threat to Israeli strikes on Iranian energy infrastructure, so the leaflets signal and apply psychological pressure rather than indicate a prepared attack on utilities. The pattern fits paid local recruits, consistent with arrests of dozens of Israelis over two years for working for Iran for money, so the Shin Bet will need to trace the printing and payment chain. Handala's claimed scale is unverified, and it may have exaggerated a drop of a few buildings. Confidence is high, because four outlets report consistently on the police statement, the website content and the claim, though they draw on the same public statements and not independent investigation.

4 sources