Israel's National Cybersecurity Directorate has issued an urgent warning to citizens about a wave of fake automated phone calls impersonating the Israel Defense Forces' Home Front Command (the military body responsible for issuing missile alerts and civil defense directives).
This is part of Iran’s emerging psychological cyberwarfare. The warning, published on the official Israeli government portal, shows how Iran and its proxies are using communications infrastructure civilian already under physical threat.
Israel: How do fake call attacks work?
The Cybersecurity Directorate said it had received dozens of reports within 24 hours of calls that appeared to come from an official Home Front Command number. The automated messages urged recipients to “prepare for an emergency” and, in some cases, directed them to visit a website for further instructions.
See also: Israel Claims to Have 'Hit' Iran's Cyberwar Headquarters
This is spoofing — a technique where attackers falsify the caller’s number to make a call appear to come from a legitimate, trusted source. In a conflict environment, where citizens are trained to respond immediately to official emergency alerts, the damage doesn’t require malware or a data breach. Panic is enough.
Reports of fake text messages
There are also reports of fake text messages from a forged sender labeled “OREFAlert” — a name designed to mimic Israel’s official missile warning system — falsely warning recipients of potential terrorist attacks inside shelters and urging them to avoid shelters until further notice.
A second fake message warned that fuel supplies would be suspended nationwide for 24 hours from midnight. The logic is coldly effective. If citizens hesitate to enter shelters during a real missile attack because they don’t trust official warnings, big problems will arise. Disinformation ,when deployed at the right time, acts as a force multiplier.
See also: US-Israel and Iran exchange cyberattacks
Israeli authorities attributed the campaign to Iranian or pro-Iranian groups operating as part of a broader effort psychological warfare during Israel’s military campaign against Iran. These campaign patterns are part of a psychological cyberwarfare strategy that Iran has long employed.
Significant increase in cyberattacks
In 2025, Check Point reported more than 2,000 threatening emails targeting Israeli universities, municipalities, and healthcare organizations, with messages containing explicit threats of violence.
Radware recorded a 700% increase in cyberattacks against Israel in the first two days of the conflict compared to the period before. A company executive attributed the increase to coordinated retaliation by Iranian state actors and pro-Iranian hacker groups , ranging from DDoS attacks, attempts to infiltrate critical infrastructure, data theft and malware distribution.
The Cybersecurity Directorate confirmed that the fake calls were part of a coordinated disinformation effort and stressed that the Home Front Command does not communicate with citizens by phone unless the individual initiates the communication first. This clarification alone signals how effectively the adversary exploited an alleged code of conduct.
Earlier this year, the Shin Bet internal security service and the Cybersecurity Directorate reported a significant increase in phishing attempts linked to Iranian operators, targeting senior defense officials, politicians, academics, journalists, and public institutions.
See also: Iranian Cyberattacks: The Threat Remains Intense
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The head of Israel’s Cybersecurity Directorate, Yossi Karadi, had publicly warned that his agency handled more than 26,000 cyberattacks in 2025 — a 55% increase over 2024 — and described the course in stark terms: “Cybersecurity no longer supports the battlefield. Cybersecurity is the battlefield.”
For security professionals and network defenders operating in any geopolitically sensitive environment, the Israeli case provides a stark lesson. The most dangerous mode of attack in a conflict may not target a firewall. It targets the decision a citizen makes when an alarm sounds. The Cybersecurity Directorate urged the public to rely solely on the Home Front Command’s official website, mobile app, and verified social media channels.
