From Iran: A New and Worrying Threat to Journalists in Israel

The Israel National Cyber Directorate warns of targeted phishing attacks against journalists in Israel, originating from Iran. The attacks are carried out via WhatsApp and Telegram, impersonating familiar figures, aiming to steal login credentials or take over the device. The Directorate has published protective recommendations, including identity verification, two-factor authentication, and reporting to hotline 119.

The Israel National Cyber Directorate has issued a warning about targeted phishing attacks against journalists and media personnel in Israel, which, according to the report, originate from Iran. The attacks are primarily conducted via WhatsApp or Telegram, impersonating familiar figures, such as other reporters, and crafting messages tailored to the target's interests, such as offering collaboration or inviting to an interview. The goal is to establish seemingly credible contact and lead to clicking a link to a supposed meeting, which leads to a fake page requesting login credentials for Google accounts, or to opening malicious files that may take over the mobile phone. The Directorate provided several recommendations: verify the identity of the contact through an additional communication channel, especially in unexpected messages containing a link or request for personal details; do not enter passwords or verification codes following a link received in a message; enable two-factor authentication on all major accounts, especially Google and WhatsApp; set up a recovery email; periodically check account logins and remove unrecognized devices; and immediately report any suspicious attempt to the organization's security personnel and to the National Cyber Directorate's hotline 119. The report notes that the attacks come against the backdrop of recent developments, but does not detail specific cases or the scope of the phenomenon.