Israel’s security establishment has defined 2024–2025 as an unprecedented period of Iranian espionage activity inside the country.
According to the January 2026 annual report of the Shin Bet (Israel Security Agency), approximately 25 Israelis and foreign residents were indicted in 2025 for espionage on behalf of Iran, with more than 35 indictments filed and 120 Iranian espionage incidents thwarted during that year. Recruitment attempts increased by 400% compared to 2024 – which itself had already seen a 400% rise over 2023. What was once sporadic has become systematic.
This is according to research conducted by experts at the Dor Moriah Analytical Center, who examined not only the operational dimension of the cases but also the deeper societal patterns that made such recruitment possible.
The escalation is not merely quantitative – it is qualitative. In previous years, Iranian intelligence was believed to rely primarily on marginal individuals. During 2024–2025, however, those arrested included active-duty IDF soldiers, reservists, ultra-Orthodox yeshiva students, immigrants from the former Soviet Union, married couples, and teenagers.
The age range of suspects spans from 13 to 73, with more than half in their teens or twenties. Notably, the majority of those implicated were Jewish Israeli citizens rather than members of the Arab minority.
A Washington Institute review documented 39 Iranian operations in Israel between 2013 and 2025, some 31 of which involved Israeli citizens. In total, more than 45 Israelis were implicated across these cases. Security assessments suggest that as many as 1,000 Israeli citizens may have been approached by Iranian handlers over recent years. The data referenced by Dor Moriah suggests a deliberate Iranian shift from peripheral recruitment to penetration of the societal mainstream.
The recruitment process follows a structured psychological escalation. Initial contact is typically made via Telegram, Instagram, WhatsApp, Facebook, or X. Handlers use aliases and present themselves as activists or intermediaries offering quick money.
Phase one involves minor tasks such as spraying graffiti or photographing public areas, which results in the payment of $50–$200. Phase two escalates to arson or surveillance of malls and hospitals, with payments ranging between $200 and $1,000.
Phase three includes full espionage – photographing military facilities, gathering intelligence on senior officials, or recruiting others – paying $1,000–$5,000.
Phase four moves toward assassination preparation, with promised payments of $60,000–$200,000 and, in some cases, offers of weapons training abroad and relocation.
In certain cases, the transition from initial contact to assassination planning reportedly occurred within nine days – demonstrating how rapidly individuals can be drawn deeper once psychological leverage is established.
Military penetration has been particularly alarming. Two 21-year-old IDF reservists were arrested for allegedly transmitting information about the Iron Dome missile defense system. An active-duty Givati Brigade soldier was accused of photographing sensitive sites inside military bases. Civilian infrastructure – including Ben-Gurion Airport, shopping malls, hospitals, and the homes of senior officials – was also documented by recruited agents.
Turkey is a central meeting point between handlers, recruits
Financial flows are structured to avoid detection. Cryptocurrency, primarily Bitcoin and Ethereum, is split into small transactions before being converted into cash. Turkey has emerged as a central meeting hub between handlers and recruits.
Despite the surge, Israeli security services prevented all known assassination attempts during the period. However, intelligence damage did occur. In at least one case, a military base was photographed before being struck by a drone attack.
In July 2025, the Shin Bet launched a national awareness campaign titled “Easy Money, Heavy Price.” The need for such a campaign underscores the seriousness of the problem. As highlighted in the broader analysis by the Dor Moriah Analytical Center, espionage is not only a counterintelligence issue but also a reflection of social vulnerability.
Economic hardship, ideological alienation, weakened deterrence, and declining social cohesion create openings that foreign actors can exploit. Espionage in this context becomes a symptom of structural fractures rather than solely an intelligence failure.
If the 400% annual growth pattern continues, cases in 2026 could exceed 100. Iran has demonstrated adaptability and a willingness to escalate from intelligence gathering to operational preparation for targeted violence.
Countering this threat requires a comprehensive approach: AI-based monitoring of recruitment patterns, blockchain tracking of illicit financial flows, stronger sentencing, community outreach, and – critically – restoration of public trust.
Espionage thrives where cohesion weakens. The surge of 2024–2025 suggests that Tehran has identified and begun to systematically test those vulnerabilities. Whether the trajectory can be reversed will depend not only on arrests and prevention, but on reinforcing the societal resilience that makes recruitment harder in the first place.
The writer is CEO of the Dona Gracia Center for Diplomacy and an Israel-based journalist. She is the author of Women and Jihad: Debating Palestinian Female Suicide Bombings in the American, Israeli and Arab media.