How Iran used social media to stoke tensions between Israelis
How Iran used social media to stoke tensions between Israelis
An investigation by the Fake Reporter organization reveals that since 2021, a foreign network with ties to Iran has been operating in Israel, spreading lies, incitement and hate on social media, using dozens of fake profiles and impersonating real people to sow division
Last January, a video showing demonstrators with pride flags burning the image of Rabbi Chaim Drukman, one of the leaders of the Religious Zionist community who had passed away a week earlier, quickly spread on Facebook, X, WhatsApp, and Telegram, circulated by real users and fake accounts alike. Right-wing users and media could not contain their anger. "Do not absolve yourselves of the heavy responsibility for this demonstration of anti-Zionism and antisemitism," wrote Menny Asayag. Yair Netanyahu, the son of the Prime Minister, was quick to respond: "Remember what they did to Jews who defaced an image of Arabs at a wedding? Arrest and indictment... not that it interests the police, of course." Channel 7 also reported on the incident with the headline "Rabbi Chaim Drukman's image burned in left-wing protest."
They, along with many other users and journalists, were unaware that they had fallen victim to a trap set by a foreign entity, likely Iran, and not only in this case. An investigation by the organization Fake Reporter reveals that since 2021, a foreign influence network connected to Iran has been operating in Israel, spreading lies, incitement, and hate to deepen the rift among Israelis, and to use them to extend its influence beyond the virtual world.
The network's activity is made up of dozens of fake profiles, bots, groups, and other accounts on WhatsApp, X, Telegram, Facebook, TikTok, and Instagram, and uses dating sites and fake websites to create and promote various influence campaigns. These include spreading malicious content and misinformation about fake election results, incitement against the LGBTQ+ community and ultra-Orthodox Jews, and impersonating well-known journalists, social activists, and rabbis. Since the outbreak of the conflict in Gaza, the network has focused its efforts on activities related to the protest by families of hostages and has even reached out to prominent figures in the protest to mobilize them.
"A two-year study has demonstrated that our enemies are not just at the gates but within," Fake Reporter CEO Achiya Schatz told Calcalist. "These days we are focused on our physical borders and we cannot neglect the virtual borders, through which foreign parties create conflict among us, manipulate innocent people, and gather intelligence. The time has come to understand that this is a new and real threat to democratic societies worldwide, and certainly to a country with many enemies like Israel. It is time for a national plan to promote information and digital literacy alongside a broad initiative to regulate social networks in Israel. Until this happens, citizens will continue to encounter Iranian agents on WhatsApp and Russian lies in the newspapers."
Fake Reporter's investigation began in November 2022, after the research team found accusations of fraud in the elections held earlier that month. Among other things, these allegations included a fake screenshot of Yair Netanyahu claiming that Benny Gantz and Yair Lapid were trying to commit election fraud. The screenshot was simultaneously published on several suspicious profiles linked to each other and active since 2021. This publication allowed researchers to start the process of exposing the wider network.
The investigation revealed that since 2021, the network worked to establish and build digital assets such as fake profiles or Facebook pages and groups like "The Second Israel," aimed at the LGBTQ+ community. Initially, the network focused primarily on spreading slanderous messages against the LGBTQ+ community and the ultra-Orthodox public.
In January 2023, the network achieved its greatest success with the distribution of a fake video that depicted left-wing protestors burning of Rabbi Drukman's image. The video was initially circulated in a WhatsApp group managed by the network. It was based on footage of a demonstration held during the coalition negotiations and was edited to include an image of Rabbi Drukman.
During the protests against the government’s judicial overhaul plan this past year, the network focused on Telegram and Twitter, where content encouraging and supporting the protest was disseminated. During this period, an account associated with the network under the name Sarah Efron approached administrators of protest groups on WhatsApp, asking to distribute extremist cartoons, such as one depicting Itamar Ben-Gvir and Bezalel Smotrich riding a donkey with the head of Prime Minister Benjamin Netanyahu.
Starting from October 7th, the network focused on disrupting and exploiting the struggle of the kidnapped families through Telegram channels and Facebook accounts, including those on Twitter and TikTok, under the name "The Second Israel." Posts published by the network included attacks on the Prime Minister (for example, "Netanyahu is the main cause of this disaster"). The content was copied from pages of protest supporters while minimizing content from pages supporting Netanyahu. The network also created original content, such as a video criticizing Netanyahu's lack of empathy towards the kidnapped and a deep fake video of the Prime Minister. The user Sara Efron even appealed to the administrators of the WhatsApp groups of the families of the hostages to receive information about protest groups and to convince activists to distribute materials mocking Netanyahu, Ben-Gvir and other elected officials.
Fake Reporter investigators identified three main methods used by the network. The first is gathering information and deploying agents. “Sarah Efron, complete with an American phone number and a stolen profile picture of a couple, contacted the administrators of WhatsApp groups in Rehovot during a protest against the judicial overhaul,” Fake Reporter researchers wrote in a report published by the organization. "Sarah suggested that they use special graphics she designed with her husband for the protest, including an image of Netanyahu in flames. After the start of the conflict, ‘Sarah’ expressed interest in the fight to return the hostages and asked to join WhatsApp groups on the subject, reaching out to at least one open group, contacting its admin, and offering the posters she designed for the protest. There is concern that the profile established contact with other admins.”
Other accounts associated with the network, including "The Second Israel," posted pictures and videos including one that depicted Russian President Vladimir Putin dressed as Hitler with the caption "Putin is a war criminal." A video of the poster in Haifa was shared by accounts linked to the network, including an account impersonating Israel's former Ambassador to the UN Gabriela Shalev. "This indicates that the network was able to recruit supporters and even get them to act in the real world in order to promote and continue to spread its message. In practice, Israeli citizens acted in the name of the network, on Israeli territory, apparently without their knowledge," the report said.
The second method of these actors is deepening rifts between different segments of the population. The fake video of Rabbi Drukman's effigy being burned was the most prominent example, but not the only one. "A very large part of the content distributed on the digital assets of 'The Second Israel' concerned the issue of the abductees," researchers said. "The main message was that the government, and especially Netanyahu, don’t care about them and that they are viewed as as good as dead. It is also claimed that foreign citizens would receive better treatment, in an effort to demoralize and encourage immigration throughout the war.”
Prior to this, the network also engaged in incitement against the LGBTQ+ and ultra-Orthodox communities. The campaign aimed to strengthen the belief that there is no one to talk to and promoted a narrative that the gaps in Israeli society cannot be bridged, suggesting it's better for secular and ultra-Orthodox populations to separate geographically and ideologically. Hateful content against the LGBTQ+ community included messages like "This is not love, this is hate," along with images of same-sex couples. There were also graphics featuring the pride flag in a trash can with the caption "Sick queers, get out of here," an image of a donkey and a cow in pride flag colors with the caption "A parade of animals," and former Health Minister Nitzan Horowitz, who is gay, depicted as Satan. The counter content included images with the pride colors of a fictional movement called "The Movement to Stop Haredim," an image prohibiting side curls and shtreimels, quotes about Ben-Gvir falsely attributed to Yair Lapid, and an image in pride colors with the caption "Hatred is against Judaism."
The third method is the creation of fake organizations and impersonating real people. Notably, the network impersonated well-known rabbis and influencers. Fake Reporter investigators identified accounts impersonating seven rabbis (Zvi Kostiner, Reuven Elbaz, Aharon Biton, Shmuel Eliyahu, Shlomo Amar, Avigdor Nabnetzel, and Eliyahu Maksomov), all of whom had expressed views against the LGBTQ+ community and the Pride Parade. These accounts managed to recruit hundreds or thousands of followers. "All of these profiles, across various social media networks, still exist, and the inciting content still appears in them," say Fake Reporter researchers.” Rabbi Shlomo Amar's YouTube channel, which also still exists, stands out in particular, as it includes fake audio clips that attack the gay community and call for the denial of women's rights, including the right to vote. The impersonator's voice does not sound the same as Rabbi Amar's, and pronunciation mistakes can be identified, but many believe that it is real."
Three Twitter profiles were also identified that impersonated well-known social activists and were used to spread pro-LGBTQ+ and anti-Orthodox content. "A profile was found impersonating Idit Klein, the president and CEO of Keshet, an organization that works for equality for the Jewish LGBTQ community. Even today, the account is still active and Google even refers to it. Another account impersonated Yehudit Plesko, a Jewish feminist theologian, as well as journalist Omar Schubert. His name and biographical details were stolen, and a picture that was not his was attached to them. In this case, too, we recognize a pattern we have already identified in the past among fake foreign accounts, in which they contact activists by presenting themselves as journalists and request to receive digital assets related to protests."
The researchers also identified several profiles in Hebrew and English that pretended to be fake organizations, all with unique logos. The network also established two fake news websites, through which it disseminated fabricated quotes from Yair Netanyahu against Yair Lapid.
