Iran-Linked Hackers Claim Responsibility for Tel Aviv Flyer Distribution
Police in Israel are investigating thousands of threatening leaflets found in mailboxes, a move attributed by the Handala group to a coordinated physical operation.
By Anthony Lawson ·
The Israel Police and the Shin Bet security agency began a joint investigation into a series of flyers discovered in mailboxes across northern Tel Aviv on Monday. The leaflets, which contain a QR code linking to a website with threatening text, were collected by officers as evidence. Authorities stated that the investigation would proceed in coordination with the national security service.
A screenshot released by police shows the destination webpage for the QR code is titled "Warning from Handala team." The Handala group is a hacker collective linked to Iran that has previously released data from devices belonging to Israeli officials. The website displayed a message in broken Hebrew addressed to the Israeli public.
The text on the site warned that if Israeli leaders attacked the energy infrastructure of the "resistance front," the public should prepare to pay a heavy price. The message claimed that on the day of such an attack, no power station, oil refinery, or water desalination facility would remain in the "occupied territories." It further stated that energy and water systems would shatter like glass from south to north.
The website concluded by calling the message a final warning. It presented a choice between wisdom and sinking into darkness and the silence of catastrophe. Police confirmed that officers arrived at the affected addresses in Tel Aviv to gather the physical flyers for analysis.
The Handala group claimed responsibility for the distribution on its Telegram channel. The group stated that it had placed hundreds of thousands of leaflets in the heart of Tel Aviv. It described the operation as a shock to the illusion of Zionist security.
According to the group's statement, dozens of operatives participated in the night's activities. The hackers wrote that residents had heard their voices from within the city. They threatened that repeating foolishness would demonstrate the true meaning of threat and the collapse of security in the shadows.
Israeli authorities have arrested dozens of individuals over the past two years on suspicion of acting on behalf of Iran in exchange for money. Investigators note that Iranian agents often begin recruits with mundane tasks like vandalism or filming public locations before escalating to more severe offenses.
The Handala group has targeted multiple US and Israeli entities since the start of the Iran war in late February. In March, the group carried out a destructive cyberattack against Stryker, a Michigan-based medical supplies firm. Later that month, it leaked personal emails belonging to FBI Director Kash Patel.
In April, the hackers published photos of the work and family life of former IDF chief Herzi Halevi, including images of previously undisclosed meetings. The group also claimed to have hacked the phones of former prime minister Naftali Bennett, former justice minister Ayelet Shaked, and Prime Minister Benjamin Netanyahu’s former chief of staff, Tzachi Braverman.
In February, the group claimed it had accessed the files of Clalit, Israel’s largest healthcare network. It posted medical records online that it said belonged to 10,000 Israeli patients. The current investigation into the physical flyers marks a shift in tactics for the group, combining digital threats with street-level presence.
