Cyber Security News

Israeli Social Media Users Targeted in Covert Iranian Influence Campaign

A covert Iranian social media operation has been uncovered, targeting Israeli users on platform X with a psychological campaign designed to sow discord and despair.

Researchers at the Foundation for Defense of Democracies (FDD) have exposed a Persian-language Telegram channel, CAR ONLINE (@caronline_original), which boasts over 400,000 subscribers and serves as the orchestration hub for this malign influence effort.

This channel provides detailed instructions for creating fake X accounts that impersonate Israelis, complete with curated lists of demoralizing Hebrew phrases such as “my children just scream” and “I’m tired, God save us.”

To evade detection by X’s moderation systems, CAR ONLINE advises its followers to modify these phrases, ensuring the posts appear organic while spreading narratives of fear and hopelessness among the Israeli public.

Unveiling a Sophisticated Psychological Operation

The operation’s technical sophistication is evident in its step-by-step guidance on leveraging artificial intelligence tools like ChatGPT for translating Persian content into Hebrew, alongside recommendations for account naming conventions that blend Hebrew and non-Hebrew identities to enhance authenticity.

CAR ONLINE also promotes its successes by showcasing coordinated X posts from accounts posing as Israelis, while managing a parallel presence on X under the handle @caronlineX.

This account amplifies content inspired by the Telegram channel’s directives.

While the Telegram group claims to have enlisted 60,000 participants, FDD has yet to verify this figure, highlighting the opaque scale of the operation’s reach.

Indicators of Iranian Origins

Evidence strongly suggests Iranian involvement behind CAR ONLINE, as the channel has linked to an account on EITAA, an Iranian messaging platform, and operates a website, caronlineofficial[.]com, hosted on an Iranian server.

The same Iranian phone number listed across its Telegram and Instagram profiles further ties the operation to the country.

This is not an isolated incident; FDD notes a precedent in Iranian influence campaigns, such as the “Revolutionary Twitter – X” (@twtenghelabi) operation targeting the 2024 U.S. elections with similar crowdsourcing tactics.

These patterns indicate a persistent strategy of exploiting Western social media platforms for psychological warfare, extending CAR ONLINE’s presence beyond X to platforms like Instagram.

The technical challenge for platforms like X, Meta, and AI providers such as OpenAI lies in countering these evolving threats.

Traditional automated detection systems, which flag synchronized posting or identical content, are inadequate against networks that deliberately diversify their messaging and behaviors.

According to the Report, FDD emphasizes the need for in-depth investigations to map the actors, tactics, and coordination forums driving such campaigns.

Without robust intervention, the abuse of generative AI and social media infrastructure for disinformation remains a potent risk.

Western tech companies must prioritize dismantling these networks to safeguard users from orchestrated psychological operations that exploit digital spaces for geopolitical gain.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates

Aman Mishra

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

2 days ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

2 days ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

2 days ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

2 days ago