The Other Face of War: Iranian Regime–Linked Manipulation of Israel’s 2026 Election Debate

6. Mapping the network

Starting from the anchor personas, the investigation mapped 119,717 accounts and 294,980 relationships. The operation is embedded inside that graph, among the journalists, politicians and engaged citizens whose conversations it enters. The analytical task was to separate the operation from the audience it targets. Figure 2 shows the evidential core: 70 accounts that the evidence places inside, or in direct operational contact with, the network.

The accounts shown in Figure 2 and examined in the following sections are a sample drawn from that dataset, selected because together they document every layer of the operation and every type of evidence. The total number of accounts associated with the network is substantially larger. All of them have been collected, mapped and retained in Golden Owl's dataset, together with their relationships and timelines. Section 6.3 sets out the scale of that wider footprint.

Figure 2. The persona network. Node colour shows the analyst classification, and node size shows connections within the subgraph. Red dashed lines mark verbatim shared text. Iran-app accounts carry a red outline, and gold stars mark assets named in the Israeli government report. The dark red node stands for the Iran-based and Iran-app accounts that the ring follows. Grey nodes are genuine opposition hubs that the personas target.

6.1 Five working layers

The network is not a single homogeneous cluster. It resolves into layers with distinct jobs, typing habits and technical fingerprints, bound together by follows, shared text and shared amplifiers:

Every seed is reachable from every other seed through follow edges. @yaarashalev is the structural centre: six of the first nine seeds follow it, and it follows six of them back. 1,255 accounts are linked to two or more of the 21 seeds, and the second-hop neighbourhoods of the suspicious accounts are markedly younger than the rest of the graph (Section 9).

6.2 The KigVoice pipeline: content supplied by a named Iranian channel

The most direct operational link in the dataset is a content pipeline. We compared every caption posted by @kig_voice, the X account of the KigVoice channel named in the government assessment, with Yaara Shalev's timeline. 14 of KigVoice's 40 collected posts (35%) reappeared as the caption or opening line of a later Yaara post.

·         The direction never reverses. In every case KigVoice published first. The delay ranged from 9 to 68 hours, with a median of 29 hours. No Yaara post was later picked up by KigVoice.

·         It is laundering by amplification. KigVoice's originals drew a combined 188 views. Yaara's republications of the same lines drew 13,077 views.

·         It includes the election message itself. Yaara's most characteristic election slogans, "Your vote is your power" and "This year we choose differently", originated on KigVoice. So did her Qatargate line, "Money is stronger than any warning".

·         It is sustained. The transfers run continuously from 30 August to 21 September 2026, roughly every one to three days, across topics including taxes, transport, Haredi exemptions and the election.

An ordinary activist who admired a nine-follower account might share its posts occasionally, with attribution. What we observe instead is systematic, unattributed republication of a named Iranian channel's captions as the persona's own words, within a day or two, for weeks. In the transfers captured in Evidence 2, Yaara republished not only KigVoice's caption but the same AI-generated video. The evidence shows that KigVoice and Yaara Shalev draw on the same content supply, with KigVoice acting as a staging channel and Yaara as the persona that carries the material to Israeli audiences. We assess this link with high confidence.

6.3 The wider footprint

The personas and channels documented in this report form the evidential core of the operation, and the accounts named here are a representative evidentiary sample selected for publication. The network extends well beyond them. Applying the same indicators across the full mapped graph yields a layered footprint of accounts that belong to the operation, are connected to it, or operate alongside it in the same Iran-linked environment:

The layers overlap and carry different levels of confidence, so they are not presented as a count of operated accounts. Together they show the scale of the environment in which the personas operate: a coordinated core embedded in a far larger layer of foreign-based, recently created and Iran-connected accounts reaching into the Israeli election conversation. Golden Owl holds the complete account lists, relationship data and timelines for every layer. They extend well beyond the examples published in this report.

7. Operated from Iran: the Iran-app ring

X's transparency panel records, for each account, the client build it connects through. For most Israeli users this reads "Israel Android App" or "Israel App Store". For four of the personas in this network it reads "Iran Android App". That is X's own label for the Iranian regional build of its Android application.

All four present as Israelis, post in Hebrew about the election, and are geolocated by X to Germany or Finland. Three were created in the three months before the election. The combination of a European location label with an Iranian client build is what one would expect from operators inside Iran reaching X through European VPN exit points or proxies, a common arrangement given that X is blocked in Iran. It is not what one would expect from Israeli expatriates.

7.1 "Alon Strauss" used to write in Persian

The clearest case is @mardeankabooti. The handle is Persian, mard-e ankabooti, meaning "Spider-Man". The account was created in 2019, and until April 2026 it posted exclusively in Persian, arguing with other Iranian users about Khamenei and Iranian politics. Its last Persian-language posts in our collection date from April 2026. On 26 August 2026 it re-emerged as "Alon Strauss", with an Israeli flag as its avatar, posting Hebrew hashtags for The Democrats and Yair Golan and calling Netanyahu "the most disgusting animal in nature".

Its following list tells the same story. Among the accounts it follows, 114 carry hard Iran signals: they are based in Iran, use the Iranian app, or are tied to Iranian outlets. They include Foreign Minister Abbas Araghchi, former Foreign Minister Javad Zarif, Yousef Pezeshkian (the President's son and adviser), Khamenei news accounts, an account dedicated to the late President Raisi, and Iranian journalists and clerics. Its followers include accounts located in Tehran. This is an Iranian user's account, rebranded as an Israeli voice nine weeks before the election.

7.2 A signature only this ring uses

Three of the Iran-app personas (Raamihadad1985, tlmqr1990 and mardeankabooti) append the same block of eight political handles, in the same order, to their posts: @gadi_eisenkot @naftalibennett @Israelzari @EitanGinzburg @YoraiLahav @yairlapid @meretzparty @HavodaParty. Across the 119,717 accounts in our graph, no other account uses this block. Two of them also share an identical block of Democrats hashtags. The ring is bound by mutual follows: Raamihadad1985 follows tlmqr1990, Ivandray50 and mardeankabooti and is followed back by all three. It is also mutual with @BeitHamikdash0, a right-wing "Temple Mount" persona created on 2 August 2026, which is discussed in Section 12.

7.3 "Ivan Derai" addresses "our Israeli people" in Arabic

@Ivandray50 writes Hebrew election content, including a designed "35 days to the election. No more." poster listing Netanyahu as "responsible for the disaster", "employer of Qatari agents" and "destroyer of the economy". It also slips into Arabic. Replying to an account, it wrote the same blessing twice, first in Arabic ("God bless them for their efforts to show the truth to our Israeli people who are being deceived") and then in Hebrew. It ends a Hebrew sentence with the Arabic question mark "؟". It posted within ten minutes of @VSeaberg61374 fifty times and of @miriamkozakk twenty-nine times.

7.4 How the ring connects to the rest of the network

· @Raamihadad1985 follows and retweets @miriamkozakk, replies to @Michael53du_X, and follows @ella_kauf, a Cluster B writer who is also followed by @mardeankabooti.

· @ella_kauf follows @VSeaberg61374, @miriamkozakk and @DaveActNow (the Press TV Hebrew follower and top amplifier), and is mutual with @heeejokera_j1ng, an Iran-app account.

· @KeminMari95505 (created March 2026, based in Germany, Iran Android App, 0 posts, 699 followed accounts) follows both @yaarashalev and @ella_kauf.

·  @Harpatqan (Persian-language posts, United States label, Iran Android App) and @nbl255871565775 ("آنابل", United States label, Iran Android App) follow @yaarashalev.

·  @heeejokera_j1ng ("Teddy Daniels", location "tehran !", Netherlands label, Iran Android App) posts in Persian about Iranian clerics.

7.5 Adjacency to Iranian state outlets

Beyond the app build, a targeted scan of the graph found 2,645 accounts with at least one Iran indicator and 157 with hard indicators, meaning platform-attested Iranian location or client, or direct relations with Iranian outlets. 121 accounts in the graph are based in Iran or use the Iranian app, 86 of them through the Iranian app, including the Iranian officials, state journalists and clerics followed directly by "Alon Strauss". The network's relations to Iranian Hebrew-language outlets are these:

·         @yaarashalev follows @kolhamappa, the government-named channel.

·         @DaveActNow, the single largest outside amplifier of the network (17 retweets of Yaara, 5 of Miriam), follows @presstvhebrew (Press TV's Hebrew service) and is mutual with @kolhamappa.

·         @MaisMht85126 follows @presstvhebrew and replied to it on 6 May 2026. That exact reply text was reposted verbatim four months later by @redline123z, a Hebrew persona that X places in Lebanon.

·         @Roben35647 (Europe label, West Asia app) follows @Iranhayom ("Iran Today", Iran's Hebrew outlet) and @yaarashalev.

·         @SheeraAlon (Jordan Android app) follows @presstvhebrew and @yaarashalev. @GoniKalin60800 (Yemen Android app) is mutual with @kolhamappa and follows @yaarashalev.

·         In March 2026, during Iranian missile attacks, @kolhamappa replied to @miriamkozakk: "Total victory, and now 50 dead in Shoham, thanks for the perfect defence Bibi". That post drew 684 views, the channel's largest audience.

8. "Israelis" who are not in Israel

X's transparency data allowed us to compare where each Hebrew-speaking persona claims to be with where the platform places it. Of the Hebrew-presenting accounts linked to the seeds, 192 are based outside Israel. Many of these are genuine: Israeli journalists abroad, expatriates in Europe and North America, and diaspora Jews. We classified those as diaspora-plausible and set them aside. 48 remained in countries with no plausible Israeli diaspora, and 23 of those are in the Arab world.

Figure 3. Left: Hebrew "Israeli" personas linked to the network, located by X in countries with no plausible diaspora. Right: the operational fingerprints (platform location and client build) of the classified personas. Red bars mark the Iranian app build.

Sub-Saharan and Southeast Asian entries include commercial spam (fake massage and "donation" bots) and some expatriates. We do not count them as evidence of the operation. The Arab-world entries are different in kind: they are fluent-looking Hebrew political personas with Israeli names and Israeli self-presentation, linked to the core accounts.

8.1 Shared fingerprints

Beyond single locations, identical combinations of location and client build recur across personas that also share text. That pattern indicates common operating infrastructure rather than coincidence:

·         Europe / North Africa Android app: @gwldh48971 ("Galia Raz", "Israel") and @MaisMht85126 ("Yuval Abramov", "israel"), two Cluster B writers who share text with each other's circle.

·         Europe / West Asia Android app: @AvrahamiDa13508 ("David Avrahami", "United States") and @WYylwn41269 ("Orit Aloni"), both of whom share verbatim text with other personas.

·         Romania / Ukraine Android app: @VSeaberg61374 ("Vanessa Seaberg") and @Lili62M, registered 30 seconds apart on 18 May 2026 at 02:21 UTC. Both reply to and amplify Yaara.

·         Germany / Iran Android app: three Iran-app ring members and @KeminMari95505.

Exhibit 9. "Dasha" (@Dashaxnepe): a Russian-language bio and "Netanya" location on an account created in August 2026. X places it in Italy. It posts Hebrew political replies and once swore at another user in Russian.

9. Manufactured freshness: new accounts and renamed shells

Influence operations need accounts, and accounts made for an election tend to be made shortly before it. Of the 32 classified personas, 26 (81%) were created in 2025 or 2026, and 19 in 2026. For comparison, only 11% of the 6,004 distinct X authors in the Phase 1 election conversation were created in that period. Among the seeds' direct neighbours the figure is 8%. In the second-hop neighbourhoods of the suspicious accounts it rises to 20%, or 23,970 accounts.

Figure 4. Top: creation dates of the classified personas against election day. Accounts created before 2025 are listed at left. Bottom left: monthly account creation in the direct and second-hop neighbourhoods. Bottom right: the share of accounts created in 2025 or 2026 in each population.

9.1 Coordinated renaming

Username changes are recorded by X with a timestamp. Several personas were renamed in ways that only make sense under common control:

·         @E_katrina_s (formerly @Nurten343732, a Turkish name, now "Ekaterina Smirnova") was renamed on 14 September 2026 at 07:31:41 UTC. @Malishalev was renamed the same morning at 07:42:32 UTC, eleven minutes later. The two accounts share ten verbatim texts.

·         @Michael53du_X is the former @Eitan_X_, renamed on 6 September 2026.

·         @Musa35m85 was created and renamed on the same day, 13 January 2026. @Anatlevy_67 changed handle twice on its creation day.

·         @Ayelet_Goren_ is a 2017 account reactivated and renamed in May 2026. @EapinozaDaniel is a dormant 2014 account from Oregon that resumed in September 2026 with Hebrew image posts published on the hour, at 13:00, 15:00, 16:00 and so on (15 of 26 posts), which is the signature of a scheduler.

·         @yaarashalev (2012) was renamed in July 2025. @mardeankabooti (2019) switched from Persian to Hebrew in August 2026.

Exhibit 10. "Ekaterina Smirnova" (@E_katrina_s): created April 2026, formerly @Nurten343732. It writes Hebrew election replies using masculine first-person verbs under a female persona.

10. One script, many voices

Independent people rarely publish identical paragraphs. We ran duplicate-text detection over 19,415 posts from 923 accounts in and around the network and found 67 cross-account matches (59 exact) across 33 account pairs. Once coincidental matches ("hahaha", greetings) are removed, the rest form a shared text library that moves between personas.

Figure 5. Verbatim and near-verbatim text moving between accounts over time. Each arrow runs from the first appearance to a later copy. Red arrows mark content originating with Iranian outlets: the Press TV Hebrew reply and the KigVoice caption pipeline.

10.1 What the library contains

The message deserves attention in its own right: an Iranian threat is used to argue that re-electing the Prime Minister would endanger Israelis. The two personas that published it were renamed eleven minutes apart and share nine further texts.

Exhibit 11. Miriam Kozak's post using a 7 October victim to brand the attack the "Netanyahu massacre". The identical paragraph appeared on @Michael53du_X 62 hours later.

One copied line exposes the copying mechanism. The insult "צאי לנו מהחיים חלאה" ("get out of our lives, scum") is grammatically feminine. It was first aimed by a genuine Israeli account at a female protest leader. @Malishalev and @E_katrina_s then pasted it, unchanged, under posts by male politicians. A native speaker adjusts the verb without thinking. A copy-paste operator working from a text bank does not.

10.2 Non-native Hebrew

Operators who type Hebrew on devices set up for Arabic or Persian switch between two right-to-left keyboards, and the switch leaves traces in the text. So do operators who learned Hebrew as a second language, or who rely on machine translation:

11. Synthetic faces and synthetic outrage

Generative AI is now part of mainstream Israeli campaigning: parties across the spectrum publish AI videos, and Israeli law requires disclosure. What sets this network apart is how it uses AI: to fabricate the identity of the persona itself, and to mass-produce degrading imagery of the Prime Minister and his family for distribution through accounts that pretend to be Israeli citizens.

11.1 A synthetic identity

The "Shabbat Shalom" selfie that Yaara Shalev published in November 2025, showing a young woman with a Star of David drawn on her palm, is an AI-generated image. Our analysis attributes it to a commercial image generator (Google's Gemini). The image does what a persona needs: it gives a fabricated Israeli woman a face and a patriotic gesture.

11.2 The Netanyahu imagery factory

Across the network, AI video follows a consistent template: a realistic rendering of Netanyahu, often with "7/10" written on his forehead, placed in humiliating scenes with a Hebrew caption. The template recurs across personas that share text and followers:

11.3 Admissions and suppliers

·         @MaisMht85126 replied to Netanyahu's account on 22 September: "I asked Gemini to create an image of a psychopathic, demented dictator in the twilight of his days", attaching the result.

·         @Raamihadad1985 (Iran Android App) quote-posted AI content with "This is just one example of the content this small group produces with AI".

·         @macho_man36, a US-based English-language hobbyist who labels his videos "Made with AI", offered his "Bibisitter" AI parody to Yaara Shalev: "I really love your cartoons. I wanted to share with you a video I recently made with AI." We assess macho_man36 as a probably genuine individual and exclude him from the network. The exchange still shows how a persona hub can source ready-made synthetic media from authentic users.

Exhibit 18. An AI video by @macho_man36, labelled "Made with AI" by X. The account offered similar content to Yaara Shalev and is assessed as a probably genuine user, not a network member.

12. One content model

The personas differ in persona, typing habits and infrastructure, but they publish the same argument. Read together, their output resolves into a consistent set of pillars that recur across every layer of the network, from the government-named hub to the Iran-app ring and the Arab-world personas.

12.1 Pillar one: 7 October as the "Netanyahu massacre"

The central claim is that Netanyahu is personally responsible for 7 October. It escalates from failure, to betrayal, to deliberate complicity. The phrase "טבח נתניהו" ("the Netanyahu massacre") and its variants, "ממשלת הטבח" ("the massacre government") and "גוש הטבח" ("the massacre bloc"), turn a national trauma into a personal indictment.

12.2 Pillar two: treason and Qatari money

The Qatargate affair is framed as proof that Netanyahu sold Israel for money. Miriam Kozak's "We have a Qatari agent!" drew 5,009 views on 21 September. Yaara's version, "Money is stronger than any warning", came from KigVoice. Another Kozak post, "He sold us for money. Hundreds of millions. And because of that our sons and brothers were murdered", was the persona's most viewed post in our sample, at 9,594 views.

12.3 Pillar three: Haredi exemptions and unequal sacrifice

The draft-exemption dispute is framed as a moral contrast between those who "serve, work and pay taxes" and "draft-dodging parasites" kept in power by Netanyahu. It is Yaara's signature theme: "Netanyahu is asking for your vote again. For what? More exemptions for the Haredim, more taxes and pressure on the working public, more Qatari penetration, and more security failures."

12.4 Pillar four: war for survival, and an election that may be stolen

This pillar matters most for election day. It primes Israeli audiences to read any security escalation as a political manoeuvre, and any defeat for their camp as fraud.

12.5 Pillar five: collapse, emigration and the delegitimisation of the IDF

The most corrosive content says that Israel is finished and that leaving is rational. Yaara's most viewed post in our collection, at 688,434 views, reads "When violence becomes routine, leaving becomes the solution". A companion post says "Israel is not emptying by chance". @EdenBoker_, of the Miriam cell, claims that "300,000 Israelis left during his term". @Anatlevy_67 goes further, calling on reservists to refuse service and describing the army as a militia:

@AmelaiaPrance, which presents as a pro-Bennett Israeli woman in Hebrew, dropped the mask when replying to Turkish accounts: "Israel, this bitch, needs to be disciplined so that it doesn't bite anyone again. I am Israeli, but I hate and am ashamed of the crimes my country commits against humanity." No Israeli opposition voter writes this. It is the language of an operator addressing a different audience.

12.6 Pillar six: the countdown and the call to vote

The personas maintain a running countdown to "27.10" ("52 days to the turnaround", "35 days to the election", "27.10: we will stop him") and a direct call to vote Netanyahu out. That call is copied, as shown, from a government-named Iranian channel.

12.7 Both poles

The network is not ideologically committed. "Miriam Kozak" pushed claims of Arab electoral fraud and anti-left messaging in 2022, and switched sides later. Inside the current Iran-app ring, @BeitHamikdash0 runs a right-wing "Temple Mount" identity from Jerusalem that posts about IRGC threats and a Pezeshkian-Putin meeting, and bulk-retweeted 35 posts of a single account within two minutes. It posted within ten minutes of the anti-Netanyahu persona @E_katrina_s 260 times in the collection window. Running both camps is how an operation maximises friction rather than any electoral outcome.

12.8 Blending in: the vocabulary test

If the personas used a vocabulary unlike real Israelis, they would be easy to spot. We measured signature phrases across 1,573 original persona posts and 8,501 Hebrew posts from the Phase 1 election conversation:

The result is itself a finding. For most slogans the personas use the language of the authentic opposition at similar rates. They are built to blend in. The clearest outlier is the collective "massacre government / massacre bloc" framing, which appears about five times more often in the network than in ordinary discourse. That rate reflects the Cluster B writers, who use it as a house style.

13. Echoing Tehran: alignment with Iranian state narratives

To test whether the content model tracks the preferences of the Islamic Republic, we reviewed the election coverage of Persian-language Iranian state and state-aligned media between May and September 2026, including IRNA, Tasnim, Mehr, Fars, ISNA, the state broadcaster's news services and Jam-e Jam. We then compared their framing, pillar by pillar, with the personas' output.

13.1 How Tehran frames the Israeli election

Two features of the Iranian coverage stand out. First, Tehran does not endorse any Israeli candidate. It amplifies opposition polling because Netanyahu's decline supports a story of Israeli crisis, not because it wants his rivals in power. Second, much of the coverage recycles genuine Israeli criticism, selected and headlined so that separate grievances (7 October, hostages, Haredim, courts, war and polls) form a single narrative of decline.

13.2 The alignment

Figure 6. Narrative prominence coded from 0 (absent) to 3 (strong) in Iranian state media and in the persona layers. This is analyst coding of the reviewed material, not a statistical model.

The personas reproduce Tehran's package almost completely, translated into first-person Israeli grievance. The strongest overlap lies in the causal chain. Iranian outlets argue that Netanyahu widens regional war to secure his personal political survival, that Israeli soldiers and civilians pay the price, and that the election is the reckoning. Yaara's June post on the Iran war, Miriam's "he only opens fronts", VSeaberg's "Netanyahu is prepared to sacrifice soldiers for an extreme coalition" and the Iran-app ring's Democrats hashtags all follow that chain.

13.3 Where the personas go further than Tehran

·         They tell Israelis how to vote. Persian outlets describe Israel's crisis to their own public. The personas, speaking as Israelis, urge Israelis to act on it: "Your vote is your power". That is audience adaptation, and the KigVoice pipeline shows the adapted slogans coming from an Iranian channel.

·         They escalate from failure to treason. Iranian media mostly use the language of failure and responsibility. The personas escalate to deliberate betrayal ("he deliberately did not wake up").

·         Miriam Kozak is openly Iran-favourable. It wrote that "Iran is on the way to victory" and that "Hamas is here, Hezbollah is here, Iran is laughing at everyone". In August 2026 it wrote: "Bibi is the best prime minister for the Iranians... If you ask the Iranians: let Netanyahu be the next prime minister." During Iranian missile attacks it spread a false claim of 23 civilians killed in Nahariya and asked "Don't we have any interceptors left?"

·         They push harder on fraud. Malishalev's "rig the election or start a war" is sharper than anything in the Persian establishment coverage, which prefers postponement and manufactured-emergency scenarios.

13.4 What alignment does and does not show

Narrative alignment is never treated as proof on its own, because many of these arguments are also made in good faith by genuine Israeli critics. Here the alignment does not stand alone. It is carried by accounts that connect through the Iranian app, by an Iranian user's rebranded account, by personas operated from the Arab world, and by a persona that systematically republishes a government-named Iranian channel. Taken together, these make the alignment operational rather than coincidental: the network is a delivery mechanism for the narrative the Islamic Republic wants Israelis to absorb before 27 October.

14. How the network reaches real Israelis

Many personas in this network deliberately keep a low profile. That is a design choice, not a weakness: their influence comes from placement, repetition and borrowed amplification, which carry their messages to audiences far larger than their own followings. Together with the two flagship personas, they generated roughly one million views in a single month (Section 14.4).

Figure 7. Top left: pairs of personas posting within ten minutes of each other, by number of such events. Top right: the accounts that most often retweeted two or more personas, coloured by where X locates them. Bottom: estimated reach of the network in the 30-day campaign window, from total views down to named accounts (logarithmic scale; see Section 14.4 for method).

14.1 Reply seeding under large accounts

The personas concentrate their replies under the same large, authentic opposition accounts, such as @BaruchSharon1 (retweeted or engaged by 13 of the 21 seeds), @AmiDror (connected to 18 of them), @lirishavit, @gadi_eisenkot and @YairGolan1, where visibility is high and the audience is already receptive. @VSeaberg61374 published 20 one-line anti-Netanyahu replies to 20 different accounts in fifteen minutes on 22 September, and 30 more on the previous morning. @Musa35m85 posts about ten items a day, 79% of them replies, built on one rigid template.

14.2 Choreography between personas

·         Companion personas reply under Yaara in the evening. Yaara answers them the next morning, for example replying to Malishalev, E_katrina_s and Musa35m85 within seven minutes on 21 September (06:13 to 06:20 UTC).

·         Pairs of personas repeatedly post within ten minutes of each other: Dashaxnepe and miriamkozakk 43 times, VSeaberg61374 and miriamkozakk 33, Ivandray50 and VSeaberg61374 50, and BeitHamikdash0 and E_katrina_s 260.

·         Miriam Kozak retweets its own posts in bursts (53 of 120 recent items) and retweeted three posts of a 17-follower feeder within 104 seconds.

14.3 Borrowed amplification

Across the persona posts we collected, 362 distinct accounts (not counting the personas themselves) retweeted at least one persona, and 27 retweeted two or more. Of the retweeters whose location X discloses, 276 of 362 (76%) are based in Israel. Most are genuine Israeli opposition supporters who have no idea who they are amplifying. A minority are throwaway amplifiers, such as accounts with auto-generated handles that have posted 20,000 or 40,000 times since late 2025 while having a handful of followers.

This is the decisive mechanism. A foreign-operated persona drops a line into a busy Israeli thread. Real Israelis like, retweet and repeat it. By the second step the content has an authentic Israeli face, and the operation's fingerprints are gone. The top outside amplifier of the network, @DaveActNow, is itself Israel-based, and it follows Press TV Hebrew and is mutual with the government-named Kol Hamappa.

14.4 Engagement and audience: how many accounts did the network reach?

To estimate the network's footprint, we measured every post authored by the 31 network accounts that were active in the 30-day campaign window (23 August to 22 September 2026). Retweets of other people's content were excluded, and duplicate records were removed. The overt Iranian outlets (Press TV Hebrew, Iran Hayom) are not counted. Because timelines were collected up to a fixed number of recent posts, the most prolific accounts (Miriam Kozak, for example) are covered for only part of the window. For those accounts we also give a linear extrapolation to the full 30 days.

Where the reach comes from

Two flagship personas carry the largest audiences. Yaara Shalev accounts for 83% of measured views, driven above all by one emigration video ("When violence becomes routine, leaving becomes the solution") that was displayed 688,434 times. Without that single post, the network's measured views would be about 258,888. Miriam Kozak accounts for 63% of all interactions. The wider persona layer multiplies that reach. Its accounts seed replies under large Israeli accounts, manufacture the appearance of agreement, and feed lines to the anchors; the Iran-app ring alone generated 10,862 views in the window while operating as a distribution layer.

The effect on the audience

·         Audiences respond to the personas as if they were real. Across all network posts there were 1.0 interactions per 100 views. In the ordinary Hebrew election conversation on X from Phase 1 (8,492 posts) the rate was 2.8. Where the network has built a following, it far exceeds that baseline: the Miriam cell draws 7.3 interactions per 100 views and the Cluster B writers 6.0, more than twice the norm. These audiences are not merely exposed. They like, reply and share.

·         Yaara's videos travel far beyond her followers. They are watched far more than they are discussed (about 0.2 interactions per 100 views for the core cell). That is the profile of algorithmically distributed video, which carries the emigration and decline message to audiences who never follow the account.

·         The amplification is authentic Israeli amplification. 76% of the named retweeters are located in Israel. Every one of those retweets relays a foreign-operated persona's message to that person's own followers with an Israeli face attached.

·         Past effects are documented. The Miriam Kozak persona's AI image of Netanyahu was circulated by genuine Israeli politicians as evidence of incitement (2024), and its fake Facebook group for MK Naama Lazimi drew about 8,000 genuine Israeli members before removal (2025). The same persona now reaches tens of thousands of views a week on X.

Method note. Views are impressions, not unique people. Follower counts overlap between accounts. X does not reveal who liked a post, so the number of distinct engaging accounts is estimated from the one interaction type that can be resolved to named accounts: across 805 retweet records we found 362 distinct retweeters, a ratio of 0.45 accounts per interaction. That ratio is applied to all interactions. The second-hand audience sums the followers of the retweeters without removing overlap and is an upper bound. All other figures are lower bounds, because timelines were capped and the second-hop expansion covered only suspicious neighbours.

15. The architecture: from visible amplification to embedded personas

Golden Owl's February 2026 research described an Islamic Republic-linked influence architecture with differentiated roles: originators, amplifiers, automated or centrally operated accounts, and less visible actors embedded in communities whose trust they could draw on during a crisis. The election investigation shows how that role-based approach can be adapted to a domestic electoral audience. The most consequential activity is not necessarily the most visible. A low-profile seeding layer supplies material, while accounts presenting as Israelis carry it into political debate through posts, replies and coordinated amplification.

Several patterns define the architecture observed in the election case:

·         The source is separated from the public voice. KigVoice's limited visibility contrasts with the reach of Yaara Shalev, who republished 14 of its captions as her own posts.

·         The visible accounts appear local and varied. Personas present as Israeli women, reservists, secular voters or religious activists. Some use patriotic imagery and first-person accounts of national concerns. Their political positions are not uniform.

·         Coordination is distributed. Different accounts seed replies, repeat text, publish media or reinforce another persona's posts. Shared wording, timing, account histories and network relationships expose connections that individual posts do not.

·         The operation enters existing debates. Its accounts use grievances and language already present in authentic Israeli discussion. Political viewpoint alone cannot distinguish an operated persona from a genuine voter.

·         Real users form the outer reach of the network. Israelis who engage with persona content can extend its circulation, but their interaction does not make them participants in the operation.

Compared with the broader network examined in February, this case places particular weight on concealing the seeding layer and embedding coordinated activity among less obvious accounts. The two studies examine different audiences and datasets; they establish a development in the observed method across these cases, not a measured replacement of every earlier tactic.

15.1 Efficiency and operational economy

This architecture can generate exposure without requiring every operated account to become prominent. A caption can be produced once, carried by a more credible persona, reinforced by small accounts and then repeated by authentic users. In the documented KigVoice-Yaara transfers, the 14 source posts received a combined 188 views, while Yaara's republications received 13,077. That difference illustrates the value of moving material from a low-visibility source to a better-placed public voice; it does not, by itself, measure the operation's total impact.

The network also gains efficiency from reuse and placement. Copied text reduces the need to create a distinct message for each persona. Replies beneath established Israeli accounts give small profiles access to active audiences without first building large followings. Varied identities allow the same broad themes to enter different communities, while genuine engagement extends distribution beyond accounts the operators appear to control.

The economy is therefore one of content, attention and visibility: a relatively obscure source can support multiple public-facing actions, while modest activity travels through conversations that already exist. Distributing those actions among small accounts also makes coordination harder to recognise from posting volume alone. Compared with the broader, more visible amplification patterns documented in Golden Owl’s February research, the election case shows the Islamic Republic–linked method operating through quieter seeding, plausible local identities and borrowed reach, an adaptation that increases concealment while making more use of each message and account.

16. Attribution and confidence

16.1 Assessment by layer

16.2 Competing hypotheses

16.3 Accounts we excluded

Rigour requires showing what is not part of the operation. The following were examined and excluded:

·         @macho_man36, a US-based English-first hobbyist producing labelled AI parodies. Probably genuine.

·         @bain_rami, an Israel-based account whose insult was harvested by the personas. A victim of copying, not a member.

·         The large opposition accounts the personas reply to and farm (@AmiDror, @BaruchSharon1, @lirishavit, @YairGolan1 and others). These are targets and vectors, not members.

·         Israeli journalists that X labels "West Asia" (for example Tal Schneider and Ilan Lukatch), and a prominent journalist it labels "Sri Lanka". Location labels alone are not evidence.

·         Commercial spam accounts in Nigeria, Benin and Thailand that use Hebrew names to sell services.

·         The roughly three quarters of retweeters who are genuine Israelis.

17. Implications for 27 October

With five weeks to go, the network is active, growing, and aligned with the narratives most likely to matter on and after election day. Three risks stand out:

1.       A pre-built legitimacy crisis. The personas are already telling Israelis that Netanyahu will "rig the election or start a new war" if he is losing. The authentic Phase 1 conversation shows both camps primed to call a defeat fraudulent. A foreign network that can inject synchronised claims into both camps on election night is positioned to magnify a real crisis.

2.       Security events as "campaign theatre". Any military escalation before 27 October will be framed by this network, as it already is by Iranian and allied media, as a manufactured emergency. That erodes trust in genuine security warnings.

3.       Demoralisation and turnout. Emigration, refusal and "the country is finished" messaging, with reach of up to 688,000 views for a single post, targets civic confidence itself, not any one party.

Indicators to monitor through election day

·         Synchronised posts from the network claiming Netanyahu is manufacturing a security emergency, delaying the election or preparing fraud.

·         New KigVoice captions reappearing on Yaara Shalev or other personas; new Iran-app accounts following the ring.

·         Activation of right-wing personas (the BeitHamikdash0 model) with mirror-image fraud claims against the opposition, the courts or Arab voters.

·         False voting information: fake polling-station changes, "online voting" links, postponement claims.

·         Bulk account renaming or creation in the final two weeks.

Conclusion