The Shin Bet, Israel’s internal security agency, and the National Cyber Directorate announced Sunday they’ve identified a new wave of phishing attempts by Iranian intelligence operatives targeting Israeli journalists and media personnel. The attacks aim to obtain information amid recent political and security developments, according to the statement.
1+The outreach comes primarily through WhatsApp or Telegram, with attackers posing as familiar contacts and sometimes even other journalists. The messages are tailored to the target’s areas of interest and work, and include collaboration offers, interview invitations, or requests for a conversation.
Under the scheme, victims are asked to click on a link to what appears to be a meeting. The link may lead to a fake page requesting login credentials for Google accounts, or to opening a malicious file or link that could take control of the mobile phone. The Shin Bet and cyber directorate assess that through this method, Iranian intelligence operatives are trying to gain access to journalistic sources, work materials, correspondence, and additional information.
1+Officials said the efforts are also directed at targets in the political, public, governmental, and security sectors. The cyber directorate recommends verifying the identity of anyone making contact through an additional communication channel, especially when receiving an unexpected message that includes a link, file, or request for personal information.
Recommendations also include avoiding entering passwords or verification codes following a link received in a message, activating two-factor authentication on key accounts, including Google and WhatsApp, and setting up a recovery email. In addition, users should periodically check connections to their accounts and remove unfamiliar devices or connections. Suspicious attempts should be reported to organizational security personnel and to the National Cyber Directorate’s 119 hotline.