Predictive History

The Israeli Influence Operation in Iran

4 min read

The Israeli Influence Operation in Iran

Core idea: Months before the December protests, a joint Haaretz / TheMarker investigation — corroborated by the University of Toronto’s Citizen Lab — documented an Israeli-funded, AI-driven network of fake Iranian personas amplifying pro-Pahlavi, pro-monarchy content in synchrony with Israeli military action. This is the part of the “foreign hand” question that is forensically documented rather than merely alleged by the regime.

The Investigation

Two complementary investigations underpin this: the primary forensic source is Citizen Lab Report No. 189 — “PRISONBREAK” (2 October 2025), and the human-sourced corroboration is the joint Haaretz / TheMarker investigation (3 October 2025). Together they documented an Israeli-funded, Persian-language influence operation using fake personas and AI-generated “avatars” posing as Iranian citizens on X and Instagram to incite revolt, boost Reza Pahlavi, and promote restoring the monarchy. Citizen Lab assessed it most likely run by an Israeli government entity or a close contractor (high likelihood), while explicitly noting it “cannot conclusively attribute this to a particular entity.”

The forensic indicators (PRISONBREAK)

This is the part that is research, not allegation — coordinated-inauthentic-behavior signals on 50+ X accounts (53 analyzed):

  • Dormant-then-activated: accounts created Feb–Dec 2023, but ~99.5% of posting after January 2025 — a network held in reserve, then switched on.
  • Timezone fingerprint: posting ramped at 6:00 UTC, peaked 7:00 UTC, fell off after 15:00 UTC — a work day in UTC+3 (Israel), not organic global behavior.
  • Client fingerprint: ≥75% of posts via X’s desktop web app (anomalous for a mobile-first platform).
  • Shared infrastructure: ~half registered via the same obscure “b…” email domain; identical hashtag strings; stolen/obscured profile photos (30 of 53); coordination with the @TelAviv_Tehran persona.

Synchronized with Israeli strikes

  • 13 June 2025 (12-day war opens): ≥9 near-identical posts of alleged explosions / unrest the same day.
  • 23 June 2025 — Evin Prison: an AI deepfake of the bombing posted at 12:05 Tehran time while airstrikes were still ongoing, with calls to storm the prison within ~90 minutes — timing that “strongly suggests prior knowledge of the Israeli military action.” Israeli FM Gideon Saar reposted it.
  • Co-opted authentic protest hashtags (“Death to Khamenei,” “8 o’clock cry”) to amplify inauthentic accounts.

AI-generated propaganda catalogued

Fake BBC Persian articles (BBC confirmed it never published them); a deepfake of musicians Toomaj Salehi, Mehdi Yarrahi, Shervin Hajipour singing altered “Baraye” lyrics (visible AI artifacts); water-crisis propaganda; and the Netanyahu–Pahlavi “Free Tehran” video.

The Mossad Influence Branch

Israel later confirmed the institutional capacity directly. The head of Mossad’s Influence Operations Branch — established in 2021 under director David Barnea — told Israel Hayom that “carrying out an influence operation that ultimately gets rid of someone is much cheaper and simpler than an assassination operation” — the asymmetric logic of substituting narrative for force.

What It Does and Does Not Prove

Discipline note: This investigation proves an inauthentic amplification operation promoting Pahlavi and the monarchy. It does not, by itself, prove that the 36,500 casualty figure was planted by that operation. Those are two distinct claims and must stay distinct. What it does establish: the information environment in which the casualty narrative went viral was not neutral — a known, forensically-documented actor was already operating in exactly those channels before December 2025.

Graph View

Backlinks