In recent years, Iran—and chiefly its Islamic Revolutionary Guard Corps (IRGC)—have adopted a new approach to espionage. Rather than investing in highly trained operatives or covert operations requiring months of preparation, Iran is now turning to a faster, cheaper and disturbingly effective method: recruiting Israelis from within, often using little more than a Telegram message and a promise of quick cash.
Oded Ailam, a former head of Mossad’s Counterterrorism Division and currently a researcher at the Jerusalem Center for Security and Foreign Affairs (JCFA), explains that the IRGC has abandoned traditional espionage tactics.
“They’ve embraced a model that’s direct, and disturbingly effective,” Ailam told JNS. “Through aggressive mass campaigns on social media, they are approaching thousands of Israelis with messages like ‘Want to earn some easy cash?’”
Iranian operatives no longer vet their targets thoroughly or build elaborate backstories. “A Telegram or email message offering money for a ‘simple task’—track a senior figure, snap a photo of a base—is often all it takes,” said Ailam. “Willing to try? You’re in.”
Iran’s low-cost, high-volume approach is not about sophistication but about saturation. By exploiting digital platforms and vulnerable populations, Tehran has found a new way to infiltrate Israeli society from within. Combating this threat will require Israel not just to react, but to adapt—rewriting its legal playbook, investing in public resilience and staying one step ahead in the cyber domain.
Avi Davidi, a senior research fellow at the Jerusalem Institute for Strategy and Security (JISS), adds that Iran’s efforts are not random. Rather, they are strategically targeting vulnerable segments of Israeli society.
“According to open-source reports, Iran primarily uses Telegram—though Facebook has also been involved—to recruit individuals such as Iranian Jews, Arab citizens of Israel, Haredim and immigrants from the former Soviet Union,” Davidi told JNS. “These individuals are often selected due to a combination of socioeconomic hardship, identity-related complexities, or cultural links that can be exploited.”
According to Davidi, in the case of Iranian Jews, Iranian agents “often pose as cultural or familial contacts” to build rapport. Recruitment begins with benign tasks—like internet searches—and escalates gradually to photographing sensitive sites or collecting personal data. Cryptocurrency is typically used to conceal payment trails and provide operatives with plausible deniability.
While the Israel Security Agency (Shin Bet), Israel’s equivalent to the U.S. FBI, has made notable strides in uncovering and disrupting Iranian recruitment attempts, Ailam argues that the justice system is lagging behind.
“The Shin Bet does impressive work … but once a case reaches the courtroom, the system falters,” he told JNS. “Weak evidence claims, outdated legal frameworks and lenient sentencing all contribute to a breakdown in deterrence.”
He pointed to recent cases, such as the plot to gather intelligence on Israeli Defense Minister Israel Katz and former prime minister Naftali Bennett, as proof that this is no longer just espionage—it’s an attempt to threaten Israel’s leadership and rewrite the rules of engagement.
“This isn’t a brilliant strategy—it’s just relentless,” Ailam concluded. “Iran treats its Israeli recruits not as valuable ‘assets,’ but as disposable tools.”
To counter this evolving threat, Davidi argues for a comprehensive and adaptive response that spans education, law enforcement and community engagement.
“Public awareness campaigns should focus on both informing the public and deterring potential recruits,” said Davidi. Real-life stories of recruitment, arrest and prosecution, he continued, should be publicized to serve as “cautionary tales.”
Moreover, Davidi urged the establishment of safe reporting channels so that citizens approached by foreign agents can report the contact without fear of prosecution. “Early reporting can neutralize threats before they escalate,” he said.
Outreach efforts must also be culturally tailored. “Working with community leaders, social workers and educators can help reinforce resilience, financial literacy and cyber-awareness,” he told JNS.
Ailam, for his part, advocates for a legal overhaul. “The time has come for a radical change: mandatory minimum sentences for espionage, heavy financial penalties, broad asset forfeitures. And in extreme cases of betrayal, serious consideration should be given to revoking citizenship,” he said.
Leniency, he continued, sends the wrong message. “If spies are released quickly, without fines, stigma, or financial ruin, the message is clear: Go ahead and try. Worst case, you’ll get a slap on the wrist and a short timeout.”
As both Ailam and Davidi made it clear that the stakes are no longer limited to stolen secrets; they now include the integrity of Israeli society—and the safety of its leaders.
Iran’s method mimics digital marketing: Send enough messages, and eventually, someone will bite. “Even a one percent success rate from a thousand messages is worth it,” said Ailam. “It’s a chillingly rational approach. Volume will eventually produce the quality they seek. And sadly, it works.”
In Davidi’s view, intelligence and law enforcement agencies must intensify their cyber counterintelligence efforts, closely monitoring platforms like Telegram and coordinating with social media companies to disrupt Iranian activity “in real time.”
{Reposted from JNS}
