From graffiti to murder: How Iran lures Israeli citizens into spy missions

Dozens of Israelis, from teenagers to retirees, are now facing trial after allegedly being recruited by Iranian agents online and tasked with acts ranging from vandalism to attempted assassinations. Israeli security officials say the campaign, which intensified after the October 7 Hamas-led attack and the ensuing Gaza war, was designed to inflame internal divisions and undermine national security.

In a crowded Tel Aviv courtroom, 31-year-old Vladislav Victorson and his 19-year-old partner, Anya Bernstein, sat behind glass in brown prison uniforms. Guards flanked them as a police investigator detailed their alleged missions, part of what prosecutors describe as a growing network of ordinary Israelis used as pawns by Tehran's intelligence services.

Escalating demands

According to The New York Times, their first job was relatively tame: spraying antigovernment graffiti, including slogans likening Prime Minister Benjamin Netanyahu to Hitler. Victorson and Bernstein both earned $600 before their handler – later identified by Israeli authorities as an Iranian agent – escalated the demands.

Soon, the pair were asked to sabotage electricity boxes with acid, torch vehicles and experiment with makeshift explosives made from firecrackers and hairspray canisters.

The most shocking order came with a six-figure promise: $100,000 to assassinate an Israeli professor. The handler offered to pay off Victorson's debts and resettle the couple abroad if he agreed to pull the trigger. On a fateful September night, Victorson told his contact he could soon acquire a sniper rifle. Hours later, he and Bernstein were arrested.

Bernstein's lawyer painted her as a naïve teenager who believed she was working for political activists rather than foreign intelligence. 

"She's a hapless young girl who was influenced," said attorney Iaroslav Matz, adding that she was not involved in the assassination plot.

Victorson's lawyer, on the other hand, argued that investigators had not presented direct evidence linking his handler to Iran. However, a police witness testified there was no doubt that he was acting on behalf of Tehran.

A wide net and small sums

The couple are hardly alone. The Israeli government says authorities have detained 40 citizens in similar cases since last year, solved more than 25 cases involving internet recruitment and thwarted dozens of other plots. The suspects cut across Israeli society, from secular and religious Jews to residents of West Bank settlements.

Historian Clément Therme noted Tehran appears to target individuals who reflect perceived vulnerabilities in Israeli society. "Analysis of Israel's weak points shows a pattern: Israelis born in Iran, Arab citizens, or people with frustrations and discontent," he said. 

Ordinary citizens, rather than government officials, are often the targets, chosen to exploit societal fractures in a tactic Therme describes as “entryism”, or “infiltrating groups to amplify narratives of Israel’s internal divisions". Recruits are often unaware of the larger picture, manipulated through intermediaries and simple but effective online methods.

At one end is Moti Maman, a 72-year-old businessman sentenced to a decade in prison in April after being smuggled into Iran and discussing political assassinations with Iranian officials. At the other, a 13-year-old boy accused of carrying out minor tasks for online handlers.

The payments, usually in cryptocurrency, rarely exceeded a few thousand dollars. One recruit was reportedly told to photograph military sites near Haifa port, which months later became a target for Iranian missiles during the 12-day war between the two countries. Another filmed a scientist's car at the Weizmann Institute, before being asked if he would consider throwing a petrol bomb at Netanyahu's vehicle.

Read moreTwelve-day war: Impact of Iran’s strikes censored by Israel

The methods mirrored a familiar pattern in espionage, starting with small, low-risk tasks before quickly escalating. Authorities described how recruits were often enticed with modest payments for minor assignments, which could gradually lead them into more serious and dangerous acts.

A shadow war spilling online

Israel and Iran have been locked in a shadow war for decades, waged through assassinations, proxy conflicts and now cyberattacks. Tehran's operations are highly organised, drawing on decades of experience with intermediaries and forming part of a broader asymmetric strategy. 

"Extraterritorial intelligence isn't new," Therme said. "Iran has 46 years of hybrid-strategy experience, and in cyber, they've been investing since the 2000s."

Their online campaign intensified after Stuxnet, a computer worm discovered in 2010 and widely believed to have been developed by the United States and Israel to target Iran's nuclear programme. The attack marked one of the first known uses of cyberwarfare to disrupt a nation's critical infrastructure, prompting Tehran to accelerate its own offensive cyber capabilities. Today, experts rank Iran among the world's top ten cyber powers – but mainly in offensive, not defensive, operations.

Iran's cyber reach is not limited to government targets or Israel. "They target through social media not only activists but also researchers, diplomats, military analysts – in fact, anyone in the Western academic or policy community working on Iran," Therme said.

Tehran has not commented on the ongoing Israeli trials, but officials have accused Israel of orchestrating fires and explosions inside Iran. Since the June conflict, Iranian courts have executed several people accused of spying for Israel.

'Easy money, heavy cost'

Israel has responded with a public awareness blitz. Last July, the Shin Bet and the National Public Diplomacy Directorate launched a campaign titled, "Easy money, heavy cost." Radio and social media ads show ordinary men enjoying meals with family or friends before a caption flashes: "For 5,000 shekels (around $1,500), is it worth ruining your life?"

Authorities say that's roughly what many suspects received for carrying out assignments. Those who accepted the cash are now behind bars, facing up to 15 years in prison.

For Victorson and Bernstein, who were charged with vandalism, arson and a terrorist act of conspiracy to murder, the lure of quick cash has spiralled into the prospect of long jail sentences.

Their trial – one of many playing out quietly across Israel – underscores how a digital message with the lure of easy cash can entangle ordinary citizens in a shadow war between two bitter enemies.