Israel’s Shin Bet security agency has uncovered and disrupted a foreign influence operation targeting the country’s upcoming Knesset elections, removing numerous fraudulent social media accounts used to spread misleading information and manipulate political discussions just days before Israelis head to the polls on Tuesday, October 27.
The operation, announced Thursday, October 22, was carried out in cooperation with the Cyber Department of the State Attorney’s Office and the Central Elections Committee. Security officials said the accounts had been identified as part of attempts by foreign actors to interfere with Israel’s electoral process.
The announcement came as a separate investigation by Israel’s Institute for National Security Studies revealed that networks associated with Iran, Russia, and an Islamist organization operating from Turkey have been exploiting divisions within Israeli society in the weeks leading up to the election.
According to the Shin Bet, the accounts identified during the joint operation were removed from social media platforms after investigators determined that they were being used for improper foreign influence activities.
“As part of the joint effort to safeguard the integrity of the elections and thwart attempts at improper foreign influence, these accounts were removed from the internet,” the security agency said.
The Shin Bet emphasized that it would continue working with the relevant government agencies to identify and prevent additional attempts at foreign interference.
Officials did not disclose the precise number of accounts removed, identify the countries responsible for the specific accounts targeted in the operation, or provide details about the messages they had circulated.
However, the broader threat was outlined in a detailed report released Thursday by the Institute for National Security Studies, which examined foreign activity on Israeli social media ahead of the election.
The researchers identified three prominent sources of influence operations: Iranian-linked networks, a Turkey-based Islamist network known as Isnad, and a Russian operation called Doppelgänger.
The report found that these networks have been attempting to deepen existing divisions within Israeli society by inserting provocative material into political discussions, impersonating Israeli citizens, and encouraging ordinary users to circulate their messages.
Among the issues exploited by the foreign networks are the failures surrounding the October 7 massacre, the military draft of chareidi yeshiva students, religious and secular tensions, Israel’s relationship with the United States, and public confidence in the country’s political leadership.
The researchers stressed that the principal objective of many of these operations appears to be undermining public trust rather than securing victory for any particular political party.
Foreign actors, they explained, can benefit from widespread distrust, political instability, and public anger regardless of which party ultimately wins the election.
Iran has been particularly active in attempting to influence Israeli public opinion through social media, having employed similar methods during the 2022 Knesset elections.
According to the report, Iranian-linked accounts have circulated messages appealing to opposing political camps, sometimes promoting contradictory positions on the same issues.
The apparent inconsistency reflects a broader strategy of encouraging confrontation and suspicion among Israelis rather than advancing a single political platform.
The foreign accounts frequently present themselves as ordinary Israeli citizens, using Hebrew names, photographs taken from other sources, or profile pictures generated through artificial intelligence.
Some accounts were created shortly before the election, while others had existed for extended periods before being repurposed for political influence activities.
Investigators discovered one account that had published material in Persian until April 2026 before abruptly beginning to present itself as an Israeli user posting in Hebrew.
Such accounts can be particularly difficult for ordinary social media users to identify because they participate in discussions already taking place among genuine Israeli citizens.
Rather than relying exclusively on their own followers, the operators often post replies beneath messages published by prominent journalists, politicians, and accounts with large audiences.
When Israeli users share those replies or repeat the claims contained in them, the foreign-origin material can spread to much larger audiences without its original source being recognized.
The researchers described this method as a particularly effective way to conceal the involvement of hostile foreign actors.
In some cases, multiple accounts publish nearly identical messages within a short period, creating the appearance that large numbers of people independently share a particular opinion.
One example involving the Isnad network showed seven accounts distributing closely related messages over a two-day period, using language that researchers did not identify in the authentic Israeli discussions they examined.
The report cautioned, however, that coordinated posting is not necessarily evidence of foreign interference, since domestic political organizations also organize social media campaigns.
Investigators therefore examined additional indicators, including account histories, patterns of activity, and connections between suspicious profiles.
The Russian operation identified in the report, known as Doppelgänger, has previously been attributed to Russia by American and European authorities.
According to the cybersecurity and intelligence companies involved in the research, the operation expanded its activity around the Israeli election while simultaneously conducting influence efforts connected to political developments in the United States and France.
The Russian-linked network reportedly operated dozens of accounts that distributed material and more than 1,000 additional accounts that helped amplify it.
One component involved a website designed to resemble a recognizable Israeli news outlet, complete with fabricated Hebrew-language articles.
Researchers determined that the website had been registered in May 2025 and remained available for approximately a year and a half before being used in the period preceding the election.
The material circulated through the Russian-linked network focused heavily on claims that Israel’s relationship with the United States was deteriorating.
Other recurring subjects included the possibility of confrontation with Turkey, economic instability, and Israelis leaving the country.
Unlike some Iranian-linked activity, the Russian operation did not appear to concentrate on specific Israeli parties or candidates.
Instead, researchers concluded that its messaging was directed primarily at weakening confidence in Israel’s relationship with Washington and creating a broader sense of national instability.
The Institute for National Security Studies reported that the accounts it examined as part of the Russian campaign had been suspended by October 19, and its subsequent review did not identify a new wave of Hebrew-language activity from that particular network.
The Turkey-based Isnad network employed a somewhat different approach, concentrating on messages intended to generate pessimism, frustration, and distrust.
Researchers described Isnad as an Islamist volunteer network associated with the Muslim Brotherhood movement, while emphasizing that they had not established that a foreign government directly controlled its activities.
The report also identified a troubling development in which foreign-linked accounts moved beyond online propaganda and attempted to establish direct contact with Israeli citizens.
In several cases, suspicious profiles approached political activists and offered to prepare campaign posters, organize competitions involving prizes, or obtain photographs and videos of their activities.
Other accounts attempted to communicate with journalists through WhatsApp groups.
One profile linked to Iran offered Israeli users “work for good pay,” a tactic resembling recruitment methods previously identified by Israeli security authorities in cases involving suspected Iranian operatives.
The findings are particularly concerning because Israeli authorities have repeatedly warned about attempts by Iranian intelligence agents to recruit Israelis through social media and messaging applications.
Such approaches have included offers of money for seemingly minor assignments, with some cases subsequently developing into requests involving surveillance, photography of sensitive locations, or other activities of intelligence value.
The election-related influence operations therefore raise concerns extending beyond the circulation of misleading political messages.
The researchers warned that foreign networks may also attempt to exploit events on Election Day itself, including technical problems at polling stations, delays in publishing results, or allegations of voting irregularities.
An isolated incident, they noted, could be presented without its original context and circulated widely as supposed evidence of a larger conspiracy.
Accounts that have remained inactive for extended periods could also be activated during or immediately after the election to amplify such claims.
The Institute for National Security Studies emphasized that there is no established evidence that the Iranian, Russian, and Islamist networks are coordinating their activities with one another.
Nevertheless, the groups frequently exploit the same domestic controversies, allowing their messages to reinforce broader feelings of mistrust even when their immediate objectives differ.
The researchers also stressed the importance of distinguishing legitimate political criticism from covert foreign interference.
Israeli citizens are entitled to express sharp disagreements about their government, military policies, religious issues, and political leaders. The security concern arises when foreign operators conceal their identities, impersonate Israelis, and attempt to manipulate those discussions from abroad.
The report further noted that not all material circulated by foreign-linked accounts is necessarily false.
In some cases, the operators distribute accurate information or repeat genuine criticism, relying on the concealed identity of the source and the manner of distribution to influence public opinion.
Separately, Israeli television reported that security authorities have increased preparations for possible disturbances during the election period.
Those preparations include additional security deployments and strengthened command centers in Yehuda and Shomron, where officials are concerned about possible attempts to exploit heightened political tensions.
The IDF has also reportedly restricted leave for combat units until after Election Day as part of its broader security arrangements.
The Shin Bet’s announcement follows increasing cooperation between Israeli authorities and social media companies to identify suspicious accounts and remove content associated with foreign influence operations.
TikTok recently reported that it had removed material violating its policies concerning election integrity, including misleading artificial intelligence content and fake profiles impersonating public officials.
Information concerning Iranian influence campaigns was also shared with Israel’s Central Elections Committee as part of ongoing cooperation between the platform and election authorities.
The latest revelations underscore the growing role of digital platforms in efforts by foreign adversaries to exploit Israel’s domestic political disagreements.
For the Shin Bet and the Central Elections Committee, the immediate priority is preventing covert foreign operations from interfering with Tuesday’s vote.
The Institute for National Security Studies warned that the danger may continue after the ballots are counted, particularly if foreign networks attempt to undermine public acceptance of the results.