At Least 60 Israelis Have Now Been Charged With Spying for Iran After Being Recruited Through Telegram Channels

Iran has turned Telegram into a conveyor belt for espionage, and Israel's own citizens are the product.

A CNN investigation published on 11 May 2026 confirmed that at least 60 Israelis have been indicted on charges of spying for Iran since 2023, a figure that Israeli security officials describe as an 'epidemic.' Handlers operating anonymously through the messaging platform began with low-stakes assignments, then escalated targets into intelligence gathering, surveillance of military sites, and in some cases explicit requests to carry out assassinations.

The same recruitment infrastructure, the investigation found, now appears to be active in Europe, where a shadowy group has claimed at least 17 arson attacks on Jewish sites across Britain and Belgium.

How Iran Turned a Messaging App Into an Espionage Assembly Line

The mechanics of the operation are deliberately mundane. According to Israeli prosecutors and the Shin Bet, Iranian agents trawl Telegram for financially vulnerable targets, dispatching thousands of messages offering payment for what appear to be routine jobs. The initial tasks are innocuous: photograph a supermarket product, film a street corner, spray graffiti. The assignments grow from there. Israeli security officials have dubbed the campaign 'Operation Money,' reflecting how cash, not ideology, drives the vast majority of recruits.

The cases that have reached indictment stage illustrate just how far the escalation can go. State prosecutors charged two young Israelis in April 2026 from central Israel: Sagi Haik, 19, who maintained contact with an Iranian agent via Telegram from December 2025, and Asaf Shitrit, 21, whom Haik allegedly recruited.

Haik exposed identifying details about himself and his family, falsely claimed to serve in military intelligence, and sent his passport and driver's licence as part of arrangements for a meeting in Dubai. Shitrit allegedly used artificial intelligence to forge documents purporting to show secret Israeli and US plans to attack Iran.

Two other suspects, identified in separate charges, took surveillance much further. One secretly filmed inside the hospital where former Prime Minister Naftali Bennett was receiving treatment. The other filmed the Shin Bet headquarters and multiple IDF bases, sending footage directly to his handler. That second suspect, an IDF reservist at the time, was asked by his Iranian handler to assassinate his own commander in exchange for approximately £25,400 ($33,000). He did not carry out the alleged assignment. Neither suspect has yet entered a plea.

A separate case that drew considerable attention involved Iron Dome reservist Raz Cohen, who according to VINnews reporting based on Israeli police and Shin Bet statements was charged in March 2026 with passing details of the missile defence system's operation. For one specific transfer of a battery location, Cohen allegedly received approximately £770 ($1,000) in cryptocurrency. His indictment was filed at the Jerusalem District Court on charges of contact with a foreign agent and providing information to the enemy.

Shin Bet Confirms 400% Surge in Recruitment Attempts as Indictment Count Climbs

The Shin Bet's own annual report, published in February 2026, put figures to the scale of the problem. The agency confirmed that 25 Israelis and foreign residents were indicted in 2025 for spying for Iran, and that 120 separate Iranian espionage incidents were thwarted that year alone. Perhaps the most striking statistic was this: attempts to recruit Israelis increased by 400% in 2025 compared with 2024, according to the Jerusalem Post's reporting on the report. The cumulative total of indictments since October 2023 has now reached at least 60.

The range of people swept up defies any single profile. Those charged include a 14-year-old from central Israel, indicted in March 2026, who was recruited via Telegram in April 2025 and paid £900 ($1,170) in cryptocurrency for filming military headquarters, recording near hospitals, and spraying pro-Iranian graffiti. At the other end of the spectrum sit active-duty soldiers and air force technicians. One investigator from Israel's Lahav 433 serious-crimes unit told the Israeli outlet Ynet that there are likely 'dozens of spy networks, perhaps even hundreds, currently operating' inside the country.

Security analysts describe the model as 'spray-and-pray': agents send mass outreach across Telegram channels frequented by people searching for freelance work, then filter for those willing to continue. Penetrating WhatsApp and Facebook job-seeking groups is also documented; in some cases, handlers allegedly use compromising material obtained through pornography websites to blackmail individuals into cooperating, according to Israeli police statements reported by Fox News.

The IRGC Architecture Behind the Telegram Façade

Analysts who examined the network for CNN described a layered command structure with Iran's Islamic Revolutionary Guard Corps at the apex. Roger Macmillan, former head of security at Iran International, a London-based Iranian opposition media outlet that was itself targeted in an April arson attack claimed by HAYI, outlined it plainly: 'You've got a potential model where at the very top you have the IRGC or IRGC-linked organisations. You have another layer who will do the recruitment and then you have the bottom layer, the unskilled, the thugs for hire.'

Phillip Smyth, an expert who focuses on Shia militias, told CNN that the structure is deliberately designed to sever any traceable link back to Tehran. 'Part of the appeal to this is they don't have to rely on ideologically loyal and core networks that would directly track back to them,' Smyth said. 'It provides a facade for what's actually going on in Europe, so that Iran can both claim responsibility, but then also simultaneously deny it.' A source close to the Iraqi paramilitary group Kataib Hezbollah confirmed to CNN that some HAYI members are Iraqi and that the two groups are connected; Kataib Hezbollah operates under the direct or indirect command of the IRGC.

The Iranian embassy in London issued a denial via its official X account, describing the accusations as 'baseless' and alleging they served 'narrow political agendas.' Shadow National Security Minister Alicia Kearns told CNN that the Iranian playbook was not new: 'There's no question that we are seeing an increase in activity for those who are supportive or are actors of the IRGC. They'll be recruiting anyone they can.' The same model has already been documented in Sweden, where gangs known as Foxtrot and Rumba are believed to have plotted attacks against the Israeli embassy at Iran's direction.

From a Telegram message offering cash to a petrol bomb through a synagogue window in north London, the operational distance between Iran's intelligence apparatus and the streets of Europe appears to be only a few anonymous clicks.