Iran Is Recruiting Spies
in Your WhatsApp Inbox.
- 400%surgeincrease in Iranian spy-recruitment attempts inside Israel in 2024 alone — Shin Bet's own figures
- 50+indictmentsIsraelis formally indicted for spying for Iran since October 2023
- $300Ktop paymentlargest known payment to a single spy network — as low as $21 in at least one documented case
- 3platformsprimary recruitment vectors: WhatsApp, Facebook, and pornography-site blackmail to coerce cooperation
Israeli police and the Shin Bet — Israel's internal security service — have foiled the latest attempt by Iranian intelligence to recruit a spy using WhatsApp and Facebook, part of what officials and security analysts now describe as a surveillance “epidemic.” The foiled case follows a wave of arrests, indictments, and active prosecutions that has accelerated sharply since October 2023.
Iran's recruitment model is built for volume, not tradecraft. Agents flood WhatsApp groups where Israelis seek freelance work, pose as real estate brokers, drone marketers, and online dates, and use blackmail via compromising material from pornography websitesto coerce those who won't come voluntarily. The first mission is spray-painting graffiti; by mission ten, the handler is offering ₪100,000 (roughly $33,000) to assassinate a reserve commander.
The scale is documented. Israel's Shin Bet reported a 400% increase in Iranian recruitment attempts in 2024 compared to the prior year. More than 50 indictments have been filed since October 2023. One network paid $300,000 across seven suspects. Another recruit — an Iron Dome reservist — handed over classified radar and launcher data for $1,000 in cryptocurrency. One soldier received $21. He spent a year and a half in prison for it.
Israeli police and the Shin Bet announced the disruption of the latest Iranian recruitment attempt in a joint statement. The case follows a pattern the agencies have now documented across more than 20 investigations involving up to 50 suspects. In the most recently disclosed operation, Iranian handlers approached the target through WhatsApp and Facebook, posing as employers or business contacts. The pretext tasks — photographing locations, mapping routes to sensitive facilities — escalate quickly toward intelligence collection.
The target was identified and the recruitment attempt thwarted before any classified material changed hands. No further details on the suspect's identity have been publicly released. Israeli authorities emphasized the case as evidence that Iranian intelligence has shifted its primary recruitment vector to consumer social media platforms, where Israelis have no reason to treat an unsolicited message as a national security threat.
March 2026, air force moles: A joint Shin Bet/IDF/police operation dismantled a network of three soldiers and one civilianwho had maintained long-term contact with Iranian intelligence and carried out “complex security-related tasks” — including transferring documents from the Air Force Technical School and photographing train stations, shopping centers, and security cameras.
April 2026, four active-duty soldiers: Four young Israelis, three active-duty, arrested on suspicion of Iranian-directed espionage. Police described the recruits as having been contacted before their military service began — meaning Iran was pre-positioning assets before they had access to anything classified.
January 2026, the Bennett plots: Lekacho Demsash, 30, of Rishon LeZion — indicted at the Central District Court in Lod on January 5, 2026 — was arrested for carrying out surveillance missions for Iranian intelligence, including photographing near the home of former Prime Minister Naftali Bennett. Demsash is presumed innocent pending trial. A second Bennett surveillance plot was foiled within the same month.
March 2026, explosives: Haifa resident Ami Gaydarov, 22, arrested on suspicion of manufacturing explosives to target a senior Israeli figure at the direction of an Iranian handler. Presumed innocent pending trial.
Iranian intelligence has abandoned traditional Cold War tradecraft in favor of what security analysts call a “spray-and-pray” recruitment model. The Shin Bet, the Foundation for Defense of Democracies (FDD), and multiple Israeli security reporters describe the pattern the same way:
Mission 1–2: Low-stakes, deniable tasks. Spray-paint graffiti on a wall. Photograph a street corner. Payment: modest cash, cryptocurrency, or wire transfer through a foreign intermediary.
Mission 3–5:Surveillance photography. Film the entrance to a train station. Map the route to a shopping center with security cameras. Document the area around a public figure's residence. Payment increases.
Mission 6–8: Film the entrance to an air defense base. Photograph military vehicles. Identify the shift schedule of guards at a sensitive facility.
Mission 9–10: The handler asks the recruit to perform an act that would constitute a serious felony under Israeli law — up to and including assassination of a named individual. ₪100,000 (approximately $33,000) offered for a targeted killing of a reserve commander. At this stage, the recruit is fully compromised by prior conduct and the handler knows it.
The blackmail vector runs alongside this escalation. Iranian agents infiltrate pornography websites and obtain compromising material — or simply approach individuals whose financial distress, personal crisis, or ideological grievance makes them susceptible. Once a target complies with even one mission, they are photographed, logged, and owned. Refusal means exposure.
“The first task might be spraying graffiti, the second is photographing a street — by the tenth, he is being asked to assassinate his reserve commander.”
Security analysts cited by Foundation for Defense of Democracies · April 2026
The most alarming documented case in the current wave involves Raz Cohen, 26, of Jerusalem — a reservist serving in a classified role in Israel's Iron Dome air defense system. According to the indictment filed by prosecutors:
Contact date: December 6, 2025. An Iranian agent reached out to Cohen via Telegram, identified himself as an Iranian agent, and offered money for cooperation.
What Cohen allegedly sent: Three days later, on December 9, Cohen sent his handler 27 photographs and videos of Iron Dome — showing firing processes, rates of fire, backup launcher configurations, and arming procedures. He also allegedly provided the locations of seven IAF bases where he had previously served, plus the positions of two live Iron Dome batteries — one at Hatzerim base, one at Palmachim.
Payment received: Approximately $1,000 in cryptocurrency. Total.
Arrest:Cohen was called up for reserve duty on January 18, 2026 ahead of Operation Roaring Lion — Israel's large-scale campaign against Iran launched February 28, 2026. On February 18, the handler contacted him again using a profile picture of Cohen's sister. Cohen blocked the agent. He was arrested one day after the operation began.
Charges: Contact with a foreign agent; providing information to the enemy. Raz Cohen is presumed innocent until verdict.
The choice of WhatsApp and Facebook is not accidental. Both platforms are ubiquitous in Israel. Both have end-to-end encryption (WhatsApp) or opaque messaging (Facebook Messenger) that gives handlers cover. Both are used by millions of Israelis for ordinary commerce, freelance work, and community groups — making an unsolicited message from a “business contact” plausible at first glance.
Iranian intelligence has gone further: Israeli officials confirmed that Israeli diplomats were added without their consent to WhatsApp groups operated by Iranian and other hostile-nation intelligence services — effectively placing diplomats inside monitored discussion threads. The pretexts extend across every platform: Telegram channels offering freelance cash, Instagram accounts posing as online dating profiles, TikTok recruitment appeals, and X (formerly Twitter) direct messages. On April 13, 2026, a former editor at an Israeli military newspaper received a personalized text from a number labeled simply “IRGC”urging him to “stand against the brutal and stupid acts of Netanyahu.”
WhatsApp: Freelance work groups, business contacts, direct solicitation. Israeli diplomats reportedly added to hostile-nation-run group chats without consent.
Facebook / Messenger: Fake profiles posing as employers, real estate brokers, drone-marketing firms, private investigators, courier services.
Telegram:Primary operational channel for task delivery and payment; Raz Cohen's Iron Dome handler used Telegram. Handler later impersonated Cohen's sister via a profile photo change.
Instagram / TikTok / X:Mass-cast recruitment appeals, online dating pretexts, direct ideological solicitation labeled from “IRGC” accounts.
Pornography sites: Compromising material collected and held as blackmail leverage over individuals who would not otherwise cooperate.
The Israel-focused operation is not an isolated program. Iranian intelligence — the Ministry of Intelligence (MOIS) and the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO) — has deployed analogous social media recruitment campaigns in the United Kingdom, Germany, and Australia.
United Kingdom: British counterterrorism authorities arrested five Iranian nationals in May 2025 suspected of plotting an attack on the Israeli embassy in London. GB News reported Iranian agents recruiting British teenagers via social media, offering £500 (roughly $630) for basic surveillance assignments — the same task escalation pattern used in Israel.
Germany:Iran's Ministry of Intelligence (MOIS) is blackmailing Iranian dissidents in Germany by seizing a relative's phone inside Iran, accessing their contact list, and threatening to sabotage the exile's asylum case unless they attend opposition rallies and identify active participants. WhatsApp is the primary communications channel for this operation.
Global reach:IRGC-linked cyber group “APT42” (also designated as Charming Kitten) uses AI-assisted social engineering — tailored phishing, fake LinkedIn profiles, simulated conference invitations — to target journalists, academics, and government officials across the U.S., Europe, and the Middle East.
Inside Israel, the Shin Bet launched a nationwide public-awareness campaign titled “Easy Money, Heavy Price”— warning Israelis that even modest payments (roughly $1,500 in the campaign's own framing) can result in decades-long prison sentences. The campaign specifically targets young people and members of marginalized communities, whom Iranian recruiters identify through social media behavioral data before making first contact.
“In one case last year involving two soldiers, one received just $21 and has been in prison for a year and a half.”
Israeli security officials via Ynetnews and Mondoweiss · 2026
The volume model produces real intelligence returns. Across documented cases, Iranian handlers have obtained:
- Iron Dome system details — firing processes, rates of fire, backup launcher configurations, arming procedures, and the precise locations of active batteries at Hatzerim and Palmachim. (Raz Cohen case; alleged, not yet adjudicated.)
- Air Force Technical School documents — transferred by the March 2026 network of three soldiers and one civilian. Nature of documents not publicly disclosed.
- Physical surveillance of senior officials— photographs near Naftali Bennett's residence (Demsash indictment); surveillance of former Defense Minister Israel Katz.
- Infrastructure mapping — train stations, shopping centers, security cameras, military vehicle routes, air base perimeters.
- IAF base location data — seven specific bases identified by name and position in the Cohen indictment.
Iran is running the world's most aggressive social media spy recruitment program, by volume and by audacity. The model works because the threshold for recruitment is low — a desperate civilian, a financially stressed soldier, a teenager who thinks he is being paid to spray-paint a wall — and the escalation is methodical. The platforms make first contact indistinguishable from ordinary commerce.
The foiled attempt announced by Israeli police is not a success story so much as a data point in a documented epidemic. Over 50 indictments in eighteen months. A 400% surge in attempts. Iron Dome coordinates for $1,000. The Shin Bet's public-awareness campaign exists because the volume of cases has outpaced the ability to quietly contain each one.
Iran is running a factory-scale spy recruitment operation through WhatsApp and Facebook, with blackmail as a backstop for anyone who hesitates. The latest foiled attempt is one data point in a wave: 50+ indictments, a 400% surge in attempts, Iron Dome secrets sold for $1,000 in cryptocurrency, and soldiers recruited before they ever enter service. Israel is catching some of them. The platforms Iran is exploiting are the same ones every Israeli — and every American — uses every day.