A network of social media accounts posing as ordinary Israelis — including women, reservists, LGBTQ activists, religious Jerusalemites and secular voters — is being used in an Iranian-linked effort to infiltrate Israel’s political debate ahead of the Oct. 27 election, according to a new open-source intelligence investigation published Thursday.
The report by Golden Owl, published 35 days before the election, describes an operation built less around overt Iranian propaganda than around accounts designed to look like authentic Israelis arguing with other Israelis. The personas post about the same issues dominating the campaign — the Oct. 7 failures, ultra-Orthodox military exemptions, the cost of living, Prime Minister Benjamin Netanyahu, military service and distrust of the electoral process — and then reinforce one another’s messages inside genuine political conversations.
The researchers said they identified an operational core of 35 accounts, including 32 Israeli-presenting personas and three Hebrew-language media-style channels. Golden Owl assessed the network as linked to Iran based on a combination of X platform metadata, Iranian app connections, account histories, copied material, coordinated posting, linguistic anomalies and connections to influence assets previously identified by Israeli authorities. The report stresses that no single indicator — including political views, a foreign location or poor Hebrew — was treated as evidence of foreign interference on its own.
One of the clearest examples began not in Israel, but in Iran.
An X account created in 2019 under the Persian-language handle “mardeankabooti,” or “Spider-Man,” posted exclusively in Persian until April this year, according to the investigation. Its posts dealt with Supreme Leader Ali Khamenei and Iranian politics.
Then, in late August, the account underwent a transformation.
It reappeared as “Alon Strauss,” adopted an Israeli flag as its avatar and began posting in Hebrew about Israeli politics. It used hashtags associated with The Democrats and party leader Yair Golan and attacked Netanyahu, at one point calling him “the most disgusting animal in nature.”
Yet X’s transparency information continued to place the account in Germany and showed it connecting through the “Iran Android App,” the regional version of X’s application. Golden Owl found that 114 accounts followed by “Strauss” carried what it classified as strong Iran indicators, including accounts associated with Iranian officials, journalists and clerics. Among them were Foreign Minister Abbas Araghchi, former foreign minister Mohammad Javad Zarif, accounts associated with Khamenei and Yousef Pezeshkian, the son and adviser of Iran’s president, Masoud Pezeshkian.
Three other personas presenting themselves as Israelis were also shown by X as connecting through the Iran Android app. They included “Raami Hadad,” who described himself as an architect, “Talsi Makar,” who presented as an LGBTQ supporter of The Democrats, and “Ivan Derai,” whose profile used both Hebrew and Arabic. X placed those accounts in Germany or Finland. Three of the four Iran-app personas were created in the three months before the election.
Raamihadad1985: "Account based in Germany", "Connected via Iran Android App". Exhibit 4. @tlmqr1990: joined July 2026, based in Germany, connected via the Iran Android App. Exhibit 5. @mardeankabooti ("Alon Strauss"): joined June 2019, based in Germany, Iran Android App. Exhibit 6. The @Raamihadad1985 profile. Its bio misspells "architect" twice (אדריחל, ארשיתקט) and carries the hashtag "We must continue without Bibi"
(Credit: Golden Owl)
The accounts also displayed strikingly similar behavior. Three repeatedly appended the same eight Israeli political accounts, in precisely the same order, to their posts. Golden Owl said it found no other account among the 119,717 accounts it mapped using that same sequence.
“Ivan Derai” offered another clue. The account posted a designed Hebrew graphic declaring “35 days to the election. No more,” accusing Netanyahu of responsibility for disaster, damaging the economy and employing Qatari agents.
But in another exchange, “Derai” wrote a blessing in Arabic referring to “our Israeli people who are being deceived,” then repeated essentially the same sentence in Hebrew. Another Hebrew post ended with an Arabic question mark. According to Golden Owl, the account posted within 10 minutes of one suspected network account 50 times and within 10 minutes of another 29 times.
‘Yaara’ and the nine-follower content factory
At the center of the network, according to the report, is an account calling itself “Yaara Shalev.”
“Yaara” presents herself as an Israeli woman who “believes in democracy” and “dreams of peace.” The account dates to 2012 but had only about 1,000 lifetime posts when researchers examined it. Its username was changed in July 2025, after which it began regularly publishing political videos.
The @yaarashalev profile: an Israeli female persona with no verifiable biography, created in 2012 and repurposed in 2025, whose profile imagery is borrowed or synthetic
(Credit: Golden Owl)
Golden Owl said images used to construct the persona were inconsistent: some could be traced to publicly available photographs of an adult-film performer, while others appeared to have been generated by artificial intelligence. X placed the account in North America, though its transparency panel warned that the location might be inaccurate. The account connected through the West Asia version of X’s Android application.
The account’s importance, however, was not simply what “Yaara” posted but where some of the material apparently originated.
Golden Owl compared her posts with KigVoice, a Hebrew-language channel that an Israeli government assessment had previously identified as part of an Iranian influence campaign. KigVoice had just nine followers when examined by the researchers and describes itself as an “AI content production group.”
Of 40 KigVoice posts collected by researchers, 14 — 35% — later resurfaced as captions or opening lines in posts from “Yaara.”
The direction was always the same: KigVoice first, “Yaara” later.
The delay ranged from nine to 68 hours, with a median of 29 hours. KigVoice’s original versions accumulated a combined 188 views, while “Yaara’s” republications of the same material received 13,077.
Among the phrases that moved through that pipeline were “Your vote is your power,” “This year we choose differently,” “Vote with your eyes open,” “The duty is not for everyone” and “Money is stronger than any warning.” In some cases, Golden Owl said, “Yaara” republished not merely the same caption but the same AI-generated video without attribution.
The pattern continued for weeks, covering taxes, public transportation, ultra-Orthodox military exemptions and the election itself.
Two of the fourteen transfers. Bottom: the KigVoice originals, "Your vote is your power" and "This year we choose differently", each posted with an AI-generated cartoon video. Top: the same videos republished by @yaarashalev under the same captions as her own posts (the first displayed 312 times on 14 September), extended with her election text and hashtag block
(Credit: Golden Owl)
Golden Owl described KigVoice as a staging channel and “Yaara” as the public-facing persona used to carry its material into Israeli discourse.
One of those posts demonstrated how dramatically the audience could grow once content passed through a convincing Israeli persona.
An AI-generated video posted by “Yaara” depicting ultra-Orthodox men attacking a bus carried the message: “When violence becomes routine, leaving becomes the solution.”
It received more than 688,000 views, by far the biggest audience for a post cited in the investigation.
That message was part of a broader theme researchers identified across the network: portraying Israel as a country in irreversible decline and encouraging despair, emigration or refusal to serve.
Another persona wrote that “the passport remains the only salvation.” One account called on reservists to refuse military service, saying: “We used to be proud to serve; today it is a disgrace,” and describing refusal as “the most principled thing left.”
One script, different ‘Israelis’
The researchers found repeated cases in which supposedly independent Israelis published identical text.
Two personas, “Mali Shalev” and “Ekaterina,” posted the same paragraph warning that the Iranians had already marked Netanyahu and his family for assassination and that Israel could “pay a very heavy price” if he were reelected.
"Ekaterina Smirnova" (@E_katrina_s): created April 2026, formerly @Nurten343732. It writes Hebrew election replies using masculine first-person verbs under a female persona
(Credit: Golden Owl)
Miriam Kozak's post using an October 7 victim to brand the attack the "Netanyahu massacre"
(Credit: Golden Owl)
In another case, “Miriam Kozak” posted a paragraph and photograph concerning Ofir Shoshani, an IDF soldier killed in the October 7 Hamas-led terrorist attacks, on Sept. 17. Three days later, another persona published the same text and image.
Other recycled material included an attack on what one account called the “massacre government” that had first appeared months earlier as a reply to Iranian news outlet Press TV’s Hebrew-language account. In September, another Hebrew persona, which X placed in Lebanon, posted the passage word for word.
The copying occasionally exposed grammatical mistakes that made little sense to native Hebrew speakers. One insult originally written using a feminine Hebrew verb was later pasted by personas while attacking male targets.
The network also appeared to coordinate its timing.
Golden Owl found one pair of accounts posting within 10 minutes of each other 43 times and another pair doing so 50 times. The right-wing “Beit Hamikdash” persona and the anti-Netanyahu “Ekaterina” account posted within 10 minutes of one another 260 times during the period studied.
Another account fired off 20 one-line anti-Netanyahu replies beneath 20 different accounts in just 15 minutes on Sept. 22, after posting 30 more the previous morning. The personas repeatedly targeted the comment threads of prominent genuine Israeli political accounts, where they could gain visibility without building large audiences of their own.
The network did not operate exclusively from one side of Israel’s political divide, the report said.
“Miriam Kozak,” now heavily associated with anti-Netanyahu content, had during the 2022 election pushed allegations of Arab electoral fraud and anti-left messaging. Another persona, “Beit Hamikdash,” presented itself as a right-wing Jerusalem account focused on the Temple Mount and Iranian threats.
Golden Owl said the juxtaposition was important: The objective appeared to be aggravating divisions rather than consistently supporting a particular Israeli political camp.
‘Miriam Kozak’ and a fake Israeli identity with a history
“Miriam Kozak” is among the network’s largest accounts, with more than 18,000 followers.
It declares its location as Israel, while X places it in Europe. Golden Owl said 53 of its 120 most recent items were retweets of its own posts, often pushed out in rapid bursts.
The @miriamkozakk profile declares "Israel"; X's transparency data records it as based in Europe. The persona was exposed by FakeReporter in 2024 and has been linked by investigators to Iran
(Credit: Golden Owl)
The persona was already exposed as fictitious by the Israeli disinformation watchdog FakeReporter in 2024, according to the report, after it published an AI-generated image involving Netanyahu that genuine Israeli politicians subsequently circulated as evidence of incitement from the Israeli left.
The account later created a Facebook group purporting to support Democrats lawmaker Naama Lazimi. According to Golden Owl, about 8,000 genuine Israelis joined before Meta removed it following media inquiries.
That example illustrates what researchers describe as the operation’s most consequential tactic: getting genuine Israelis to do the distribution for it.
Real Israelis become the amplifiers
Golden Owl identified 362 separate accounts outside the network that retweeted at least one of its personas. Among those whose locations X disclosed, 76% were based in Israel.
Most, the researchers concluded, were genuine Israelis who apparently had no idea they were amplifying accounts assessed as foreign-operated. Golden Owl explicitly said those users should not be considered participants in the operation.
The mechanism is simple: A foreign-run persona enters a busy Israeli political thread, posts a message that sounds familiar to the audience and waits for real users to share it. Once an authentic Israeli account retweets the message, the original foreign fingerprints become much harder for subsequent viewers to see.
During the 30-day period examined, 31 active network accounts produced 1,191 original posts, replies and quotes captured by researchers. Those posts registered 947,322 views and 9,112 interactions. Golden Owl estimated the full 30-day total could exceed 1.2 million views because its collection did not capture the entire period for some prolific accounts.
The personas themselves had a combined follower count of about 23,000. But the accounts that retweeted them collectively had potential audiences approaching 293,000, though Golden Owl cautioned that figure represents an upper bound rather than the number of people who actually saw the content.
False dates, fake voting and claims of a stolen election
The broader investigation extended beyond the 35-account network.
Golden Owl examined 21,533 election-related items gathered from X, Facebook, Instagram, TikTok, YouTube, Telegram and dark-web sources between Aug. 22 and Sept. 22. About 93% were assessed as ordinary political activity.
The persona network. Node colour shows the analyst classification, and node size shows connections within the subgraph. Red dashed lines mark verbatim shared text. Iran-app accounts carry a red outline, and gold stars mark assets named in the Israeli government report. The dark red node stands for the Iran-based and Iran-app accounts that the ring follows. Grey nodes are genuine opposition hubs that the personas target
(Credit: Golden Owl)
Researchers flagged 1,516 anomalies across 10 categories, but stressed that those flags overlap and should not be read as 1,516 distinct Iranian operations or attributed wholesale to the network.
Among them were 96 pieces of false or misleading voting information.
One Yemen-based X account claimed four times within minutes that the Oct. 27 election would be postponed by a month and a week. Another account claimed the election would be “paused due to fraud and foreign interference” and referred to stopping “the machines and mail-in voting” — neither of which Israel uses in its general elections.
An Instagram post falsely claimed polling had already opened and directed users to a “voting link,” although Israelis vote by paper ballot at polling stations. Other accounts gave incorrect election dates ranging from Oct. 17 and Oct. 26 to November, August and even October 2027.
The researchers also identified 357 allegations of election fraud, 238 of them made before voting had begun.
More ominously, some personas were already preparing audiences to distrust the outcome. One warned that Netanyahu would “rig the election or start a new war” if defeat appeared likely.
Golden Owl said such messaging could become particularly significant on election night because genuine Israeli political discourse already contains fraud allegations from opposing camps. A coordinated foreign network could exploit those existing suspicions without needing to invent the underlying division.
The trail leads to Iran
The investigation mapped 119,717 X accounts and 294,980 relationships among them. Within the broader environment, Golden Owl identified 121 accounts based in Iran or connecting through X’s Iranian app and 157 accounts with what it called “hard Iran indicators.” It found 192 Hebrew-presenting accounts connected to the core that X located outside Israel, including 23 in Arab countries.
But Golden Owl cautioned against simply adding those figures together or treating every account as Iranian-operated. The categories overlap and include accounts with varying levels of evidence.
The report’s attribution instead rests on the convergence of multiple indicators: the Iranian X client, the Persian account transformed into “Alon Strauss,” systematic transfers of material from KigVoice, ties to Iranian media accounts, identical texts, coordinated posting, synthetic identities and non-native linguistic traces.
The researchers said the evidence was most consistent with an operation associated with Iran’s regime, but stopped short of identifying a specific Iranian agency, contractor or individual behind it. The open-source investigation had no access to IP addresses, login records, financial information, private communications or other internal data that could establish a formal chain of command.
Golden Owl also considered alternative explanations, including Israelis using VPNs, commercial operators and organic copying. It said VPN use could explain individual location discrepancies but not, taken together, Iranian app connections, Arabic keyboard traces, identical posts, synchronized behavior and a Persian-language account suddenly assuming an Israeli identity.
The report similarly stressed that criticizing Netanyahu, supporting the opposition or echoing an argument also heard in Iranian media was not evidence of Iranian activity. Genuine Israeli journalists, activists and political accounts examined during the investigation were excluded when researchers found no additional evidence of coordination.
Tal Hagin Photo: Courtesy“Our findings make one thing clear: the war has continued online,” Tal Hagin, a verification specialist and director of Otus, Golden Owl’s human intelligence marketplace, who specializes in open-source intelligence, disinformation and information warfare, told ynet Global. “Ahead of the election, foreign-run personas impersonated Israelis to influence public debate, and that’s exactly the kind of threat a healthy democracy has to be able to see and counter.”
The central concern ahead of Oct. 27, according to the report, is therefore not that Iran is covertly campaigning for a particular Israeli candidate. Rather, Golden Owl assesses that the operation is seeking to make authentic disagreements more combustible — pushing claims that elections will be stolen, security crises are staged for political purposes and Israel itself is collapsing.
The personas, in other words, do not need Israelis to believe Iran.
They need Israelis to believe one another.