VIPs This Way Please: FDD Exposes New Stage in Persistent Iranian Recruitment Operation

While Iran hasn’t enjoyed much success on the battlefield against Israel, its covert efforts to degrade Israel’s resilience have been unrelenting. Since October7, 2023, Iran’s intelligence agencies have increasingly acted against Israel in cyberspace, with roughly 64 percent of Iranian cyberattacks directed against the Jewish state in 2025. This publication documents a new stage of the Iranian cyber influence and recruitment operation known as “Iranian Intelligence Voice,” targeting Israelis via social media.

Iranian intelligence agencies use the internet to recruit Israelis to carry out acts of sabotage, propaganda, and even attempted assassinations in exchange for payment, with year-on-year cases growing exponentially. These operations have primarily recruited Israelis from marginalized backgrounds or those interested in making quick money — not individuals with access to sensitive information. But Iran has invested more in the past year in recruiting people who are more highly placed. So far, they have succeeded with low-ranking Israeli soldiers, some with access to Iron Dome systems or slated to serve in technical roles in the Israeli Air Force.

In the past few months, Iranian recruitment efforts have become more targeted and sophisticated. A recent Islamic Revolutionary Guard Corps (IRGC)-branded operation directly targeted Israeli government agencies and personnel by sending them text messages. Other Iranian groups have set up high-production-value websites recruiting Israelis at home and abroad to target Israeli academics for assassination.

These operations can also persist over long periods of time. A new stage in a previously exposed Iranian Ministry of Intelligence and Security (MOIS) operation — the second stage of which is documented here for the first time — represents a new development in persistent Iranian operations. The operation, titled “Iranian Intelligence Voice,” with content in Hebrew, English, and Arabic, is the revival of an Iranian campaign first active in August 2024, which called itself “VIP Employment” for the “Iranian Intelligence Service.” This first stage of the “Iranian Intelligence Voice” operation was active on Telegram, TikTok, and an Onion domain, and those platforms took down its accounts months after detection.

In the second stage, Iranian Intelligence Voice reused the name “VIPEmploymentbot” on Telegram, adding a “2” to the end. The effort focused on two Telegram channels, both titled “Iranian Intelligence Voice” one active in English and Hebrew, the other in Arabic. The Arabic channel was larger, with more than 5,000 followers compared to 2,500, though many of these followers may be inauthentic accounts created to make the channels appear more popular than they are.

Both channels promote the “VIPEmployment02” Telegram bot. Telegram bots are automated Telegram accounts that can be configured to enable automatic workflows with no human involvement. The “VIPEmployment02” Telegram bot enables those recruited to provide information and undergo a vetting process prior to being contacted by Iranian handlers. This method has two main benefits: it automates the initial process of outreach, enabling the handlers to scale, while also protecting the anonymity of the accounts used by the Iranian handlers to avoid detection.

The channels were created in late March and utilized similar appeals to Telegram founder Pavel Durov to argue against being taken down. Telegram and other platforms took them down nevertheless, concluding the second observed stage of Iranian Intelligence Voice.

This second stage exhibited similarities to other exposed cases of Iranian espionage operations. The operation’s two channels were linked to and promoted by a now-removed Telegram channel titled “MOISIRAN,” a reference to Iran’s Ministry of Intelligence and Security. The overt branding of that channel resembles a recent Iranian operation whose online presence identified itself openly as affiliated with the IRGC.

The Iranian Intelligence Voice channels invested in dual-use content for both recruitment and influence, most notably using AI tools to generate videos to entice Israeli personnel to contact them. Similar to the aforementioned IRGC operation, which focused on Israeli military and government personnel, the videos explicitly target Israeli government personnel with access to sensitive information, as well as people from “all walks of life.”

The centrality of exerting psychological pressure on Israel is evident in the operation. The MOIS channel served not only to promote the two Iranian Intelligence Voice channels and the “VIPEmployment02” bot but also to showcase, for psychological effect, content obtained through the successful recruitment of Israelis. The “Iranian Intelligence Voice” channel also forwarded material from Handala, the MOIS’s preeminent hacktivist front group, which itself is pivoting heavily toward recruiting Israelis to carry out physical acts of sabotage and influence in Israel.

In contrast to past Iranian recruitment operations, the Iranian Intelligence Voice channels frequently post news content and updates to draw a broader audience.

The channels also enjoy amplification by the broader pro-Axis of Resistance Telegram ecosystem, including pro-Houthi channels, and even reach Russia-focused channels.

This operation shows Iran is extending its weaponization of social media platforms to project influence and stretch its covert reach, targeting individuals inside Israel and potentially across Europe as well. These efforts degrade Israeli psychological resilience, tax counterintelligence agencies, and could lead to those recruited to carry out sabotage, assassinations, or even terror attacks.

Ari Ben Am is an adjunct fellow at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD), where he focuses on emerging threats, influence and information operations, cyber operations, and hybrid warfare. Joe Truzman was a research analyst and contributor at FDD’s Long War Journal. For more analysis from the authors and CCTI, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.