Iran used texts, Telegram, and cash offers to recruit Israeli spies

Before Israel initiated its conflict with Iran last month, its intelligence agencies discovered an extensive network of citizens working on Tehran’s behalf—an operation of a magnitude that stunned the nation.

Following Iran’s initial missile attack on Israel in April 2024, more than 30 Israelis were formally accused of aiding Iranian intelligence.

In numerous instances, initial contact was made through anonymous messages proposing payment for information or minor assignments. The financial incentives grew alongside increasingly risky requests.

Based on court records, Iran’s intensified espionage efforts over the past year yielded limited results, failing to achieve its alleged objective of targeting high-ranking Israeli officials.

However, the willingness of numerous Israelis to carry out basic tasks suggests the operation may have successfully gathered data on strategically sensitive locations that later became targets for Iranian missile strikes.

Conversely, Israel’s surveillance of Iran had significant consequences, enabling Mossad to identify and eliminate much of Iran’s senior leadership and nuclear scientists in a single operation in the early hours of 13 July, among other targets.

Since hostilities began, Iranian authorities have detained over 700 individuals accused of spying for Israel, as reported by the Fars news agency. However, trials have been conducted in secrecy, and at least six cases resulted in swift executions, making it difficult to assess the validity of the alleged spy network.

In contrast, Israeli prosecutions related to citizens accused of spying for Iran have been accompanied by detailed charges. Although only one conviction has been secured so far in the recent arrests, court documents reveal how Iran systematically sought potential informants.

The method often started with an anonymous text message. One such message, from a sender labeled “news agency,” inquired: “Do you have information about the war? We are willing to purchase it.” Another, sent by “Tehran-Quds” (Tehran-Jerusalem) to a Palestinian-Israeli citizen, was more direct: “A liberated Jerusalem unites Muslims. Send us details about the conflict.”

The message contained a link to Telegram, where a new conversation would begin—sometimes with a person using an Israeli name—offering money for seemingly trivial tasks. If the recipient engaged, they were instructed to set up PayPal and cryptocurrency wallets for payments.

For one suspect arrested on 29 September, the first assignment was to visit a park and verify if a black bag was buried in a specific location, with payment set at nearly $1,000. When no bag was found, the recruit sent a video as proof.