Investigation reveals Iranian-linked social media accounts posing as Israelis ahead of elections

Exposed Iranian-Linked Social Media Accounts Posing as Israeli Citizens Before Elections

Iranian-linked actors have been linked to a series of social media accounts posing as Israeli citizens and posting allegations about the upcoming election, Prime Minister Benjamin Netanyahu, and divisive issues such as the haredi (ultra-Orthodox) draft, according to a new open-source intelligence investigation published by Golden Owl on Thursday.

Golden Owl, an AI-powered open-source intelligence (OSINT) platform, mapped what appears to be an Iranian-linked interference campaign in a two-phase investigation conducted between August 22 and September 22. Researchers analyzed 21,533 posts and flagged 1,516 for anomalies, including election misinformation, foreign framing, and anomalous account identities or behavior.

Despite voting not opening until October 27, multiple accounts were found to have published pre-emptive claims that the election result would be stolen, while several others published false information about the vote itself.

Accounts based outside Israel posted claims in Arabic, Russian, and English across major social media platforms that the election would be postponed or suspended due to foreign interference, with taxes and mortgage payments frozen alongside the postponement.

Spike in electoral fraud claims

Claims of electoral fraud spiked on September 9, after Likud alleged that former Fatah official Mohammed Dahlan was behind a Haaretz report claiming that UAE President Mohamed bin Zayed had personally warned Netanyahu of an impending major Hamas operation before October 7, 2023, and again on September 17, around the time of a Supreme Court ruling banning parties from transmitting real-time voter data on election day.

“A claim that “the upcoming Israeli elections of 27 October will be postponed by a month and a week” was reposted four times within minutes on September 20 after being posted by Yemen-based @BRany4443. @Tamam3o, @Mustapha69ma and newly created US-based @GentileQueennie also claimed the election date had been moved to October 26.”>

“The first phase identified 237 accounts as suspicious actors and 57 as part of a foreign influence campaign.”>

“The research also found that dark-web sellers were offering services and datasets targeting Israel, including Telegram accounts registered to Israeli phone numbers and sold in bulk as ready-to-use sessions.”>

“SMMTG.PRO and similar services were also found to be selling Telegram subscribers, boosts, votes, and views in more than 20 countries, including subsets targeting Israeli audiences. Other listings included a database titled “Database elector.co.il,” the domain of the voter-management app used by Likud, on the DarkNetArmy forum, as well as advertisements for datasets including a “Facebook database of four million Israelis,” “Israel government phone numbers,” and Israeli election data from 2020 and 2021.”>

“Golden Owl’s investigation also identified a layered infrastructure linked to Iran that it said sought to manipulate the Israeli public. After mapping 119,717 accounts and 294,980 relationships, researchers identified coordinated personas embedded in conversations among real Israeli voters, using patriotic imagery, carefully designed language, and genuine political grievances to present themselves as Israeli women, reservists, secular voters, or religious activists.”>

“The account @YaaraShalev, which was also cited in a March 2026 situation report by the Diaspora Ministry as an example of “persona-based engagement” in Iran’s Hebrew-language influence campaign, presents itself as being run by a Jewish Israeli woman focused on democracy and peace.”>

“However, the account, first created in 2012, changed its username in July 2025 and immediately began posting political videos daily. Though the account is listed as North American, records show that the X/Twitter account is accessed through a West Asian build of the Android app.”>

“After conducting a background check across multiple social media platforms, Golden Owl found that the Persona’s identity appeared to have been assembled using borrowed and synthetic images. The photographs attached to “Yaara” across different platforms were inconsistent, with some traceable to publicly circulated images of an adult-film performer and others flagged as AI-generated.”>

“Golden Owl found that the Yaara account serves as the content hub for the network. It also contains the most-viewed post among those analyzed, with 688,434 views, calling for mass emigration from Israel.”>

“The words and narratives published in Yaara’s posts were also regularly copied from other parts of the network. Of the 40 posts researchers collected from @kig_voice, a Hebrew-language channel previously identified in a government assessment as part of an Iranian influence campaign, 35% later resurfaced as captions or opening lines in posts from “Yaara.””>

“The research also identified @miriamkozak, which has nearly 19,000 followers, as the operation’s audience node and found an anomalous pattern of self-amplification.”>

“Although the Miriam account claims to be based in Israel, X lists it as based in Europe and shows it connecting through a European Android build. The Israeli watchdog FakeReporter also exposed it as fictitious in January 2024, after it posted an AI-generated image of Netanyahu that genuine Israeli politicians then circulated as evidence of left-wing incitement.”>

“During the 2022 election, the Miriam account pushed claims of Arab electoral fraud and anti-left messaging before switching to intense anti-Netanyahu content.”>

“In 2025, it created a Facebook group “supporting” MK Naama Lazimi that drew roughly 8,000 genuine Israeli members before Meta removed it following a press inquiry.”>

Neither the ‘Yaara’ nor the ‘Miriam’ account responded to The Jerusalem Post’s request for comment.

Four other Israeli personas, @Raamihadad1985, @Ivandray50, @tlmqr1990, and @mardeankabooti, were also flagged by X’s transparency panel as accessing the platform through the “Iran Android App.” All four accounts present themselves as Israeli and post in Hebrew about the election, while X geolocates them to Germany or Finland. Golden Owl said this suggested that the accounts could be operating from inside Iran using a European VPN or proxies.”>

“Additional evidence emerged in the case of @mardeankabooti. The handle is the Persian word for “Spider-Man.” The account was created in 2019 and, until April 2026, posted exclusively in Persian, arguing with other Iranian users about Ayatollah Ali Khamenei and Iranian politics.”>

“On August 26, 2026, it re-emerged as “Alon Strauss,” with an Israeli flag as its avatar, posting Hebrew hashtags for The Democrats and Yair Golan and calling Netanyahu “the most disgusting animal in nature.”

““This is an Iranian user’s account, rebranded as an Israeli voice nine weeks before the election,” Golden Owl concluded.”>

Many of the accounts connected to the personas also claim to be Israeli, though X places them in countries where there is unlikely to be a diaspora community. The account @AviLevi67, which has changed its handle three times, is based in Egypt, as are @RonenMichil, @ytn82922, and @YuvalYitzhk5p2k. Similarly, according to X data, @AmitCigen96 and @mws1499826 are based in Yemen.”>

Many accounts created months before the election

Influence operations need accounts, and accounts created for an election tend to be created shortly before it. Of the 32 classified persons connected to the seeds, 26, or 81%, were created in 2025 or 2026, including 19 in 2026.

Some previously dormant American accounts were also reactivated years after they went cold and began posting in Hebrew, as was the case with @Ayelet_Goren_.

The accounts also often repeat the same claims. On August 26, @Malishalev posted in Hebrew, “The Iranians have already put him and his family in their sights for assassination. If he is re-elected, Israel may pay a very heavy price to protect him and his family and save their lives.” @E_katrina_s made the same post on August 31.

The two accounts that published the text were renamed about 11 minutes apart and shared nine additional repeated texts.

The repeated posts across the multiple personas share common themes, with the central claim being that Netanyahu is personally responsible for October 7. The accounts also repeat claims framing the Qatargate scandal as proof that Netanyahu sold Israel for money, that Netanyahu is allowing draft-dodging haredim to hold a powerful role in society, that Netanyahu will either rig the election or start a new war, and that emigrating from Israel is the most rational option and Israelis should refuse to join the military.

Though few of the persona accounts have large followings, Golden Owl stressed that this was deliberate design rather than a weakness in the influence campaign. According to Golden Owl, the collective aim relies on placement, repetition, and borrowed amplification, allowing the messages to reach audiences far larger than the accounts’ own followings.

In the month before publication, content from the persona network was displayed roughly one million times and generated 9,112 measured interactions, rising to around 27,475 over the full analysis window. Golden Owl estimated that 4,100 to 12,400 distinct accounts engaged with the network, including 362 identified by name. Of those, 76% are based in Israel.

Those Israeli accounts helped amplify messages from the foreign-operated personas to their own followers, potentially extending their reach well beyond their direct audiences.

Source link