Israel Warns of Tailored Phishing Traps on WhatsApp

Israel’s national cyber authority warned of a rise in targeted phishing attempts arriving through messaging apps including WhatsApp and Telegram, in messages designed to look convincing because they impersonate well-known organisations. The warning, issued in late December 2025, said the attempts are aimed at senior officials and prominent figures in fields including academia, government and the media, and are tailored to each target’s known interests.

The distinction the warning draws is the important one. In ordinary phishing, an attacker sends the same lure to everyone and waits. Here, the notice said, the attacker does not distribute a random message but builds the approach on information gathering and prior planning, the technique the security industry calls spear-phishing.

Who issued the warning

The body behind it, referred to in the original release as the National Cyber Command, is the Israel National Cyber Directorate. It was created in December 2017 by merging the National Cyber Security Authority with the Israeli National Cyber Bureau and sits under the Prime Minister’s Office, with responsibility for civilian cyber defence and for running the national computer emergency response team, CERT-IL, which handles reports from the public and from companies around the clock.

How much of this Israel is seeing

The directorate’s own annual figures give a sense of the volume behind a warning like this one. In a report covered by Israel Defense in March 2026, the directorate said it issued roughly 2,480 alerts during 2025, about two and a half times the 2024 total, and that its 119 reporting centre received around 26,500 incident reports, up 55 per cent year on year. Phishing accounted for 52 per cent of the most common attack vectors. Reporting peaked in June, during Israel’s military operation against Iran, when the centre logged 3,650 reports, 75 per cent above the monthly average. The remaining traffic clustered around supply-chain compromises, unpatched systems, remote-access connections and internet-connected devices sitting on organisational networks.

What a tailored attack actually looks like

Public threat-intelligence work gives a picture of the tradecraft. Google’s Mandiant division, describing the Iranian group it tracks as APT42 and assesses to be working for the Islamic Revolutionary Guard Corps Intelligence Organisation, documented operators who spend weeks in friendly correspondence with a target before sending anything malicious. Their infrastructure included domains a character away from real news outlets (typo-squatted versions of The Washington Post and The Jerusalem Post among them) and cloned Google, Microsoft and Yahoo sign-in pages; where a fake two-factor page failed to capture a token, operators pushed authentication prompts at the victim until one was approved. Nothing in the Israeli directorate’s warning attributes the current wave to any particular actor.

What is still unclear

The warning did not say how many attempts have been detected, over what period, or whether any have succeeded. It named no impersonated organisations and no suspected origin for the campaign, and it did not set out what recipients are advised to do beyond treating unexpected approaches with suspicion.