Iran-linked hackers claim to be behind distribution of threatening flyers in Tel Aviv

Police, Shin Bet open investigation after leaflets left in mailboxes across city's north; Handala group claims dozens of operatives handed out 'hundreds of thousands' of flyers

By Emanuel Fabian and ToI Staff Today, 5:49 pm
L: One of the flyers distributed in Tel Aviv that police believe are tied to an Iranian-linked group, on November 9, 2026. R: A website claiming to be run by the Iranian-linked Handala hacking group, the QR code for which was included on flyers distributed in Tel Aviv, on November 9, 2026. (Israel Police)

The Israel Police and Shin Bet security agency are investigating flyers that were found in Tel Aviv on Monday, for which an Iran-linked hacker group claimed responsibility.

The flyers, which feature a QR code, were found in mailboxes at several addresses in northern Tel Aviv, according to police. Police said the QR code linked to a webpage containing “threatening content.”

A screenshot shared by police showed that the website is titled “Warning from Handala team,” a hacker group linked to Iran that has previously published the contents of devices belonging to Israeli officials.

A message in broken Hebrew was written on the site warning Israelis that if “your leaders once again act foolishly and attack the energy infrastructure of the resistance front, you must be prepared to pay the heavy price for this aggression.”

“On that day, not a single power station, oil refinery or water desalination facility will remain in the occupied territories,” the message read, referring to Israel. “From south to north, your energy and water arteries will shatter like glass.”

“This is the final warning. The choice is yours: wisdom, or sinking into darkness and the silence of catastrophe,” the website continued.

Police said that officers arrived at the addresses in Tel Aviv and collected the flyers as evidence for an investigation, which the force will conduct jointly with the Shin Bet.

On its Telegram channel, the Handala hacker group took credit for the operation, claiming that it had distributed “hundreds of thousands” of leaflets in the “heart of Tel Aviv,” calling the operation “A Shock to the Illusion of Zionist Security!”

The group claimed that “dozens” of Handala operatives took part in the operation, threatening: “Last night, you heard our voice from the heart of Tel Aviv, repeat your foolishness and you’ll learn the true meaning of threat and the collapse of your security in the shadows.”

Over the past two years, Israeli authorities have arrested dozens of people on suspicion of carrying out acts on behalf of Iran in exchange for money.

Iranian agents usually start their recruits with relatively mundane tasks such as vandalism or the filming of public locations, which then escalate into more severe, sometimes even violent offenses.

Handala has targeted multiple US and Israeli companies and people since the start of the Iran war in late February, including a destructive cyberattack against Michigan-based medical supplies and services firm Stryker in March, and the leak of FBI Director Kash Patel’s personal emails later that month.

In April Handala published photos of former IDF chief Herzi Halevi’s work and family life, including those of previously undisclosed meetings. The group has previously claimed to have hacked the phones of former prime minister Naftali Bennett, former justice minister Ayelet Shaked, and Prime Minister Benjamin Netanyahu’s former chief of staff, Tzachi Braverman.

In February, the group also claimed that it had hacked into the files of Israel’s largest healthcare network, Clalit, posting medical records online it said came from 10,000 Israeli patients.

read more: