Introduction
Israel’s intelligence community is likely to remember 2024–2025 as a period of unprecedented escalation in Iranian espionage activity inside Israel. Over these two years, the change was not just in the sheer number of detected cases but in the profile of those being recruited. In the past, Iranian intelligence was believed to work exclusively with marginal elements of society. Now, those arrested include mainstream Israelis — active-duty military personnel, students at religious seminaries, and even ideologically motivated citizens acting not just for money but out of conviction. Notably, it was Jewish citizens, rather than the Arab minority, who made up the bulk of Iran’s agent network.
In January 2026, the Shin Bet (Israel Security Agency) published its annual report1. Some 25 Israelis, including Jews, and foreign nationals residing in Israel were indicted for espionage on behalf of Iran in 2025. More than 35 indictments were filed in Israeli courts. Security services thwarted 120 separate Iranian espionage incidents.
The growth trajectory is particularly striking. The number of Iranian attempts to use Israelis as spies surged 400% in 2025 compared to 2024, which itself had seen a 400% increase over 2023 and prior years1. This compounding rate of increase suggests that the threat is accelerating rapidly. While 2023 saw only a handful of cases per year, by 2025 the count had reached dozens of confirmed operations, with the actual number of contacts between Iranian agents and Israeli citizens estimated at roughly 1,000 individuals2.
Profile of a spy
The Washington Institute documented 39 known Iranian operations in Israel from 2013 to 20253. Of these, 31 involved Israeli citizens; the remaining eight targeted Palestinians or other non-Israeli nationals. Several operations had multiple participants, bringing the total number of Israeli participants across those 31 cases to more than 45 individuals. According to the National Public Diplomacy Directorate, indictments were filed against 35 Israeli citizens implicated in these cases3.
The ages of the perpetrators range from 13 to 73, with more than half in their teens or twenties3. Among those arrested was a 13-year-old boy who in October 2024 carried out tasks for an Iranian agent, vandalizing bus stops4. The young suspect was offered money to photograph the home of Foreign Minister Gideon Sa’ar. He was also asked to photograph the Iron Dome missile defense system but refused.
Several distinct subgroups stand out among the Jewish spies. The first and most numerous consists of immigrants from CIS countries and the Caucasus region. Vadim Kupriyanov, a 40-year-old resident of Rishon LeZion, was arrested for espionage, including photographing the home of former Prime Minister Naftali Bennett5. Rafael and Ellela Guliev, immigrants from Azerbaijan living in Lod, were charged with aiding the enemy during wartime and transmitting information to Iran with the intent to harm national security6. This followed their exploitation by an Iranian agent for espionage over a period of roughly three years. Vladislav Viktorson, a 30-year-old resident of Ramat Gan, and his 18-year-old partner Anna Bernstein were arrested in October 2024 for involvement in planning an assassination7. Denis Lyakhov of Rishon LeZion was charged with carrying out tasks for an Iranian agent, including filming streets and residential buildings in Petah Tikva8.
The second subgroup consists of members of the ultra-Orthodox community. Elimelech Stern, a 22-year-old ultra-Orthodox yeshiva student from Beit Shemesh, was convicted of spying for Iran9. Stern was recruited by an Iranian agent who used the alias “Anna” on Telegram4. He subsequently began recruiting others to carry out missions for Iran, including hanging posters condemning Israel’s operations in Gaza and delivering cash in Jerusalem and Tel Aviv.
The case of Yaakov Perl is particularly noteworthy. A 49-year-old American-Israeli dual citizen, Perl was arrested by Israeli authorities on suspicion of spying for Iran and charged with passing information about public figures, as well as sending videos and photographs of locations across the country to his handlers10. Perl is a member of the Satmar Hasidic sect, known for its anti-Zionist views. Authorities stated that Perl’s actions were “entirely driven by ideological motives and opposition to Zionism.” He provided the Iranians with intelligence on former IDF Chief of Staff Herzi Halevi and National Security Minister Itamar Ben Gvir, while also photographing various streets and locations throughout Israel, receiving payment in cryptocurrency.
The third group consisted of young people from peripheral towns, often from disadvantaged backgrounds. Maor Kringel, 26, of Holon was arrested in August after seven months of alleged espionage on behalf of an Iranian agent with whom he had been in contact since the beginning of the year11. Another suspect was identified as Tal Amram, also 26 and a resident of the same city, whom Kringel had recruited on behalf of the Iranians. Yoni Segal, 18, and Omri Mizrahi, 20, both from Tiberias, maintained contact with several Iranian agents for approximately one month, from mid-May until their arrest on June 1512.
Family-based spy cells have also emerged. Father and son Bassem and Tahrir Safadi, residents of the Druze village of Mas’ade, were arrested for espionage on behalf of the IRGC’s Quds Force3. A group of seven, including a father and son, was arrested in September 202413. Yubdda Israelov, 31, and Doria Achiel, 29, of Ra’anana — a married couple — were arrested on June 30, 2025, on suspicion of espionage against the State of Israel on behalf of Iran.
Military spies
The penetration of Iranian agents into the armed forces is a source of particular concern for the security establishment. An IDF soldier from the Givati Brigade was arrested by Israeli authorities in September on suspicion of spying for Iran. According to the charges, the soldier had been in contact with Iranian intelligence since July 2025 and carried out tasks for them in exchange for financial compensation. These tasks included sending photographs and videos of sensitive sites in Israel — including from inside military bases — as well as information on weapons and armaments used by the IDF. The soldier was charged with contact with a foreign agent, passing information to the enemy, impersonation, and obstruction of justice.
In January, authorities announced the arrest of two IDF reservists — Yuri Elyasov and Georgi Andreyev, both 21 — for allegedly transmitting classified materials about the Iron Dome missile defense system to Iran in exchange for payments of just $50. Critically important information about the nation’s primary defensive shield was being sold for the price of a restaurant dinner.
Recruitment: from graffiti to assassination
The psychological manipulation relies on the “salami” technique — a strategy of gradual entanglement. It starts with something that seems harmless: spray some graffiti for $50. Then the severity of assignments escalates step by step, with pay increasing in parallel. At each stage, the individual receives money, grows accustomed to the supplemental income, and perhaps improves their family’s standard of living. The dependency that forms is not merely financial but psychological — the person has already committed illegal acts, accepted payment, and walking away becomes progressively harder.
Initial contact is almost always made through social media, primarily Telegram, but also Instagram, WhatsApp, Facebook, and X (formerly Twitter)7. Agents reach out in English or Hebrew, assuming various false identities. In the Segal and Mizrahi case, the Iranian agent posed as a “left-wing activist.” Aliases such as “Martin,” “Anna,” and “Dior” are commonly used.
What follows is a method of gradual escalation that can be broken down into four phases. In the first phase, the tasks are entirely benign: spray graffiti with political slogans like “Bibi is a dictator,” put up posters, photograph streets and buildings. Payment is minimal — $50 to $200. The goal is to test the recruit’s willingness to cooperate and establish trust.
In the second phase, the assignments grow more serious: setting cars and forests on fire, moving items between dead drops, photographing shopping malls and hospitals, gathering data on security systems. Payment rises to $200–$1,000. At this point, the individual is already enmeshed in criminal activity, has accepted money, and is psychologically primed to go further.
The third phase constitutes full-fledged espionage: filming military facilities, conducting surveillance on specific individuals, and recruiting new agents — including family members3. Payment ranges from $1,000 to $5,000 per assignment. By this stage, the person has developed a dependence on the income, especially if they have shared some of the money with family or spent it on improving their standard of living.
The fourth phase involves preparation for assassination. This includes scouting potential crime scenes, with promises of weapons training abroad in Turkey or Greece. Offered compensation soars to $60,000–$200,000. An additional incentive is the promise to relocate the agent’s entire family to Iran in the event of either success or exposure.
Some cases reveal that the interval from initial contact to assassination planning can be as short as nine days. This suggests that the Iranians have learned to rapidly assess a potential agent’s psychological readiness and, when necessary, to fast-track the process.
The financial architecture of betrayal
Financial flows are structured to be as difficult as possible to trace. The primary method of payment is cryptocurrency, predominantly Bitcoin and Ethereum10. Sums are split into small transactions to avoid triggering monitoring systems. Illegal exchange services operating within Israel are then used to convert cryptocurrency into cash.
In some cases, a more old-fashioned but reliable method is employed: cash delivered by couriers. Russian couriers fly into Israel and meet agents in person to hand over money13. Direct meetings abroad are also common, primarily in Turkey, which has become the main hub for interaction between Iranian handlers and Israeli agents. Azerbaijan and Georgia are used as well.
The amounts vary widely. One-off assignments pay $50–$5,000. The seven-person group arrested in September 2024 received hundreds of thousands of shekels over two years, completing 600–700 tasks13. Over a year of active work, a single agent can earn up to $20,000 — a sum comparable to the average annual salary in Israel’s peripheral towns.
From intelligence to terror
The range of objectives that Iranian handlers assign to their agents is extraordinarily broad. At the intelligence-gathering level, the focus is on senior officials. Fares Abu al-Hija, arrested in February 2026, collected intelligence on former Defense Minister Yoav Gallant and photographed his home in Amikam. Kupriyanov photographed the home of former Prime Minister Naftali Bennett. Yaakov Perl gathered information on former IDF Chief of Staff Herzi Halevi and National Security Minister Itamar Ben Gvir. Foreign Minister Gideon Sa’ar also appeared on the target list.
Military sites constitute the second priority category. Particularly alarming was the case of the Golani Brigade base, which was photographed by agents before it was struck by a Hezbollah drone, killing four IDF soldiers13. Information on the Iron Dome missile defense system was transmitted to Iran8. A soldier from the Givati Brigade photographed military bases from the inside and passed along information about the army’s weaponry9.
Civilian targets also came under close scrutiny. Agents photographed Ben Gurion Airport, shopping malls in Haifa, Tiberias, and Tel Aviv, Ichilov Hospital in Tel Aviv, and Mahane Yehuda market in Jerusalem. Two young men from Tiberias gathered detailed intelligence on shopping malls: floor plans, the number of security guards and police in the vicinity, and emergency exits.
Beginning in mid-2024, a significant shift occurred — from pure espionage to the planning of terrorist attacks and assassinations. Seven residents of Beit Safafa were arrested in October 2024 for plotting the murder of a senior scientist6. They had collected intelligence on a mayor and several other high-ranking officials, receiving payment for their efforts. They were arrested before they could obtain weapons for the assassination mission. The investigation revealed that during the planning stage they had visited the Weizmann Institute and also photographed the scientist’s private residence for intelligence purposes.
Segal and Mizrahi of Tiberias maintained contact with their Iranian handler for three months12. They were arrested while allegedly preparing to travel to Iran for weapons training aimed at assassinating a senior Israeli figure whose identity was not disclosed to the defendants. The handlers promised each defendant 200,000 shekels ($60,000) in cryptocurrency, as well as relocation to Iran for themselves and their families upon completion of the assassination. The two men planned to meet agents in Turkey or Greece, from where they would be transported to Iran for training.
The Turkey nexus and the European trail
An analysis of Iranian intelligence operating patterns reveals the role of intermediaries who create a buffer zone between Tehran and operatives on the ground. In the case of the seven-person group arrested in September 2024, a key role was played by a Turkish intermediary named Al-Hassan, who had previously been used for short-term operations and already had experience working with Israelis13.
Turkey has effectively become the primary hub for Iranian operations against Israel. It is where agents meet with their handlers, where future assassins are promised training, and where large sums of money change hands. Azerbaijan and Georgia are also used, where sports tournaments and other events serve as cover for meetings. Following the exposure of the seven-person group, arrests of individuals connected to the operation were carried out in both Turkey and Azerbaijan13.
The European dimension is also significant for agent operations. An international investigation led by the Mossad and media exposés in Sweden revealed that Iran had used a Swedish criminal organization called Foxtrot to carry out attacks on Israeli and Jewish targets in Sweden and other European countries, including a grenade thrown at the Israeli embassy in Stockholm in January 2024, shootings at embassies in Copenhagen and Brussels in May 2024, and an attempted bombing of Elbit Systems offices in Gothenburg14. In March 2025, the U.S. administration imposed sanctions on Foxtrot and its leader Rawa Majid for their activities on behalf of Iran.
In Cyprus, on June 21, 2025, acting on Mossad intelligence, Cypriot police arrested a British citizen on suspicion of espionage and terrorism14.
Counterintelligence effectiveness
Assessing the success of Iranian operations, one must acknowledge that not a single planned assassination was carried out in 2024–2025. Every attempt was stopped by the security services, some at the very last moment.
In terms of espionage, however, the picture is less encouraging.
The Golani Brigade base was photographed by agents prior to the drone strike, which may have contributed to the accuracy of the hit13. Information about the Iron Dome system was transmitted to Iran8. The seven-person group completed 600–700 tasks over two years, amassing a vast trove of intelligence13. Agents collected detailed data on shopping malls, hospitals, and the homes of senior officials.
Following the Iranian missile strikes in June 2025, agents received special assignments to verify the accuracy of the hits and assess the damage inflicted, with the aim of calibrating future strikes13. Security services are currently investigating whether agents photographed the prime minister’s residence prior to the recent Hezbollah drone attack.
The Shin Bet’s response to the situation took the form of an unprecedented national public awareness campaign launched in July 2025, titled “Easy Money, Heavy Price”2. The very fact that such a campaign was deemed necessary speaks to a failure of the deterrence strategy. When a security agency is forced to publicly implore its own citizens not to betray their country, it is an admission of the gravity of the crisis.
The Washington Institute offered the following assessment: while Israeli intelligence has succeeded in penetrating key Iranian intelligence and nuclear agencies, Iranian espionage in Israel remains on the periphery, probing at the edges3. Since mid-2024, however, a fundamental shift has taken place — a transition from straightforward espionage to arson and assassination assignments — which has transformed the nature of the threat.
A crisis of identity
Dr. Beni Savati of the Institute for National Security Studies, analyzing cases through October 2024, concluded that these are not marginal individuals but rather people who have not fully accepted the sovereignty of the State of Israel6. Devir Kariv, a former Shin Bet officer, describes the profile of the modern potential spy as a person with economic difficulties whose national loyalty is not firmly anchored, and who can be paid to carry out espionage acts6.
The Israeli newspaper Haaretz published an article in July 2025 observing that when a senior government official in Israel has to run an awareness campaign about something self-evident, it is a sign of failure2. Deterrence is not working, the article argued, and there are those who are readily willing to break the law. When the Shin Bet is reduced to pleading “don’t spy, don’t betray,” the paper contended, it points to a society that is unraveling across every dimension — one in which all taboos have been shattered because people feel there is no law, no justice, and that they must fend for themselves because the government does not care about them. The phenomenon of spying for Iran, in this reading, is a symptom of the collapse of foundational social norms: solidarity, mutual support, and cohesion. In a society whose members have become strangers to one another and no longer feel a shared destiny, no public awareness campaign will be enough to reverse the trend2.
Strategic conclusions
If the trend of a 400% annual increase holds, the number of cases in 2026 could exceed 100. A rise in agent professionalism — through longer preparation and improved tradecraft — is likely. Following the June 2025 war, Iran needs to restore its prestige through high-profile operations, which heightens the risk of assassination attempts.
Looking ahead to 2027–2028, a diversification of methods is possible: cyber operations, attacks on critical infrastructure, the use of Israelis abroad to target Jewish communities, and coordination with other hostile actors.
Countering this threat demands a comprehensive approach. At the technological level, this means monitoring social media with artificial intelligence to detect recruitment patterns and conducting blockchain analysis of cryptocurrency transactions. Preventive measures include financial assistance to vulnerable populations, outreach to immigrant communities, and educational programs on recruitment methods.
Current judicial sentences are failing to create a deterrent effect. What is needed is real, lengthy prison terms, asset confiscation, and public trials. Social prevention efforts should focus on strengthening national identity, combating economic inequality, and integrating peripheral communities. A culture of reporting suspicious contacts must be fostered — one that does not stigmatize those who approach the security services.
Restoring citizens’ trust in the state is itself a matter of national security. Fighting corruption, ensuring social justice, and attending to the well-being of citizens are not political rhetoric — they are practical measures for countering recruitment.
Footnotes
- The Jerusalem Post. “Shin Bet: 25 Israelis indicted for Iran espionage in 2025.” January 22, 2026. URL: https://www.jpost.com/israel-news/article-884227
- Haaretz. “Spy Kids: Shin Bet Campaign Seeks to Counter Iran’s Recruitment of Israeli Teenagers.” July 24, 2025. URL: https://www.haaretz.com/israel-news/2025-07-24/ty-article-magazine/.premium/spy-kids-shin-bet-campaign-seeks-to-counter-irans-recruitment-of-israeli-teenagers/00000198-3230-d96b-a5ff-fef94eea0000
- The Washington Institute for Near East Policy. Levitt, M. and Boches, S. “Spy Versus Spy: Iran’s Playbook for Espionage in Israel.” August 26, 2025. URL: https://www.washingtoninstitute.org/policy-analysis/spy-versus-spy-irans-playbook-espionage-israel
- The Times of Israel. “Two Israelis arrested on suspicion of spying for Iran amid open war.” July 27, 2025. URL: https://www.timesofisrael.com/two-israelis-arrested-on-suspicion-of-spying-for-iran-amid-open-war/
- Iran International. “Israel arrests man accused of spying for Iran, photographing ex-PM’s home.” December 25, 2025. URL: https://www.iranintl.com/en/202512251661
- Wikipedia (Hebrew). “גיוס ישראלים בידי איראן במלחמת חרבות ברזל” (Recruitment of Israelis by Iran during Operation Swords of Iron). February 2026. URL: https://he.wikipedia.org/wiki/גיוס_ישראלים_בידי_איראן_במלחמת_חרבות_ברזל
- Maariv. “שב״כ חשף: ישראלים גויסו על ידי איראן כדי להתנקש באישיות בכירה” (Shin Bet reveals: Israelis were recruited by Iran to assassinate a senior figure). October 14, 2024. URL: https://www.maariv.co.il/news/law/article-1140021
- The Times of Israel. “Iranian agent tried to recruit two Israelis in assassination plot, police say.” June 30, 2025. URL: https://www.timesofisrael.com/police-arrest-three-more-people-suspected-of-spying-for-iran/
- The Jerusalem Post. “IDF Givati Brigade soldier arrested, charged in suspected Iran espionage.” January 2026. URL: https://www.jpost.com/israel-news/crime-in-israel/article-883423
- CNN. “Yaakov Perl: American-Israeli citizen arrested in Israel on suspicion of spying for Iran.” September 25, 2025. URL: https://edition.cnn.com/2025/09/25/middleeast/american-israeli-espionage-charges-iran-intl
- The Times of Israel. “Two Holon residents arrested on suspicion of spying for Iran.” September 30, 2025. URL: https://www.timesofisrael.com/two-holon-residents-arrested-on-suspicion-of-spying-for-iran/
- The Times of Israel. “Suspected Iran spies accused of plotting assassination of ‘senior figure’ in Israel.” July 27, 2025. URL: https://www.timesofisrael.com/suspected-iran-spies-accused-of-plotting-assassination-of-senior-figure-in-israel/
- Israel Hayom. “שבעה ישראלים ביצעו בין 600 ל-700 משימות ריגול עבור איראן” (Seven Israelis carried out between 600 and 700 espionage missions for Iran). July 6, 2025. URL: https://www.israelhayom.co.il/news/defense/article/16645061
- The Meir Amit Intelligence and Terrorism Information Center. “Possible Iranian Terrorist Attacks Abroad Following the Israel-Iran War.” July 7, 2025. URL: https://www.terrorism-info.org.il/en/possible-iranian-terrorist-attacks-abroad-following-the-israel-iran-war/