Fake Iranian accounts ‘campaigned for Netanyahu’ ahead of Israeli election

A network of fake X accounts presented itself as Iranian users and promoted Benjamin Netanyahu before Israel’s election. The accounts urged Israelis to vote for him, sometimes claiming to speak “on behalf of the Iranian people”. This matters because disguised election messaging can make political support appear broader or more authentic than it is.

The activity became especially visible on election day. Accounts posted identical Hebrew messages, used the same campaign language, and replied to other users in coordinated bursts. Two accounts shared 109 identical posts, while also responding simultaneously or within five minutes to 232 posts by 53 accounts.

The operators were not identified. Expose, a social-media monitoring company, found that about 1,600 accounts had earlier promoted Reza Pahlavi, then shifted toward Netanyahu during the campaign. The Prime Minister’s Office and Likud denied any connection. The network later returned to promoting Pahlavi after the election.

A coordinated influence operation uses multiple accounts to push a shared political message in a planned way. Its purpose is to shape what people see, believe, or discuss while making the activity look like independent public opinion. In this case, the accounts posed as Iranian users while promoting Netanyahu to Israeli voters.

The clearest signs were repetition and timing. Two accounts shared 109 identical posts, although Haaretz’s analysis expected only four through organic activity. The accounts also responded simultaneously, or within five minutes, to 232 posts by 53 different accounts. Several posted the same Hebrew election message, including calls to vote for Netanyahu and Likud.

The activity was strongest on election day, when coordinated bursts made the network especially visible. Expose identified the pattern through social-media monitoring. The operators remain unknown, so the investigation shows coordinated behavior without proving who directed it or whether any government was involved.

The reported network included 1,653 X accounts posing as Iranian users. That is a substantial number of accounts for a campaign aimed at influencing an election conversation. The network did not simply post occasional political opinions. It operated as a large group promoting a common message about Netanyahu and the election.

Its activity also looked highly unusual. Two accounts shared 109 identical posts, while Haaretz’s analysis estimated that organic activity would produce only four such overlaps. The accounts also responded simultaneously, or within five minutes, to 232 posts by 53 different accounts. Several accounts repeated the same Hebrew wording about supporting Netanyahu.

These figures do not prove how many real voters saw or believed the messages. They do show an organized pattern that differed sharply from ordinary independent posting. Activity intensified on election day, then the network reportedly returned to its usual focus on Reza Pahlavi after voting ended.

The operators of the accounts remain unidentified. The available evidence shows what the accounts did, but not who controlled them or whether they represented a government, political group, or private actors. The Prime Minister’s Office and Likud denied any connection to the network.

Expose found that around 1,600 accounts had already been identified the previous year in an influence operation promoting Reza Pahlavi. That campaign presented Pahlavi, the son of Iran’s last shah, as an alternative to the Iranian government. As Israel’s campaign gathered pace in July, 185 of those accounts began interacting with Netanyahu’s profiles.

Those interactions included sharing posts attacking Netanyahu’s political opponents. After the election concluded, Haaretz reported that the network returned to its usual focus on Pahlavi. This shift connected the campaigns through account activity, but it did not identify their operators or establish who directed them.

Undisclosed coordinated election advertising can trigger Israel’s election-advertising transparency requirements. Those rules matter because voters should be able to understand who is behind political messages. Judge Noam Solberg said the network’s activity appeared, on its face, to violate the law.

The issue was not simply that the accounts supported Netanyahu. They claimed to be Iranian users, acted in a coordinated way, and promoted election messages without identified operators. Their posts included direct calls to vote for Netanyahu or Likud. The activity therefore raised questions about whether political advertising was being presented without the required transparency.

The article does not state a specific penalty. Instead, Solberg ordered the evidence referred to police. He said the Central Elections Committee could not reach a definitive ruling because the people operating the accounts were unknown. The Prime Minister’s Office and Likud denied any connection to them.

The petition challenged activity linked to Netanyahu, Likud, and the Prime Minister’s Office. The Central Elections Committee examined evidence submitted by the Brandeis Institute and FakeReporter. Its chairman, Judge Noam Solberg, found that the network’s activity appeared subject to election-advertising transparency rules and seemed to violate the law.

However, the committee did not know who operated the accounts. That missing information prevented it from reaching a definitive ruling about responsibility before the election. The accounts claimed to be Iranian users, but their operators remained unidentified. The evidence showed coordinated behavior without establishing the people or organization behind it.

Solberg therefore ordered the evidence referred to police rather than issuing a final decision. The article does not report a later police conclusion. It does report that the Prime Minister’s Office and Likud denied any connection to the accounts after the earlier investigation was published.

Fake social-media identities can influence voters by making one political position appear to have widespread, authentic support. They can repeat messages, respond to prominent accounts, and target audiences in their language. In this case, accounts presenting themselves as Iranian users urged Israelis to vote for Netanyahu, including in Hebrew and English.

Coordination strengthens that impression. Repeated posts and synchronized replies can increase a message’s visibility and make separate accounts seem like independent voices. The network posted identical messages and answered 232 posts in close timing. The article does not establish how many voters saw the content or changed their views, but it documents the method used.

Attribution is difficult when operators’ identities are hidden. Activity can reveal links between accounts without revealing who controls them. Here, about 1,600 accounts had earlier promoted Reza Pahlavi, yet their operators remained unknown. The committee therefore referred the evidence to police instead of issuing a definitive ruling.