Iranian Hackers Drop Threatening QR Flyers in Tel Aviv

Residents across northern Tel Aviv discovered threatening flyers bearing QR codes in their mailboxes Monday morning, in what Israeli security officials are treating as a serious psychological warfare and cyber-security incident. Scanning the codes leads to a web page containing threatening content designed to spread fear and undermine public confidence.

Detectives from the Yarkon District Police were called to multiple locations, collected evidence from the field, and opened an investigation. Police issued an urgent warning to the public: "Citizens who have been exposed to these flyers are instructed not to scan the QR codes under any circumstances. Scanning may expose mobile devices to severe security breaches and the download of malicious components. Report immediately to the 100 emergency line so officers can collect the materials."

Shortly after the flyers were discovered, the hacker group Handala claimed responsibility for the operation. In a statement, the group said its operatives distributed hundreds of thousands of leaflets across Tel Aviv overnight.

According to their statement, the flyers include direct threats to strike critical infrastructure in Israel, including power stations, refineries and desalination plants, in response to possible attacks on energy infrastructure of the "resistance axis." Israeli security and police officials are verifying the claims while conducting a technical examination of the malicious links.

Iranian intelligence arm in activist disguise

Israeli and American security agencies, alongside international cyber firms, have been tracking the Handala group for an extended period. Though its members present themselves as "independent pro-Palestinian activists," intelligence assessments state unequivocally that the group is an operational cyber arm of Iran's Ministry of Intelligence (MOIS), operating under full sponsorship and funding from the regime in Tehran.

The group's arsenal of operations includes hack-and-leak attacks, breaking into computer systems, stealing sensitive data and publishing it online. The group also engages in doxxing and privacy violations: exposing personal details, addresses, phone numbers and photographs of senior security officials, employees in defense industries and civilians. Handala also conducts sabotage and destructive cyber attempts, including website defacement and deployment of malware to delete data, and wages psychological warfare through the distribution of flyers, threatening messages and coordinated campaigns on social media.

Handala group logo

The group has previously claimed breaches of systems belonging to Israeli security bodies, government institutions and private companies, and has leaked email correspondence of public figures. In May, the group claimed it had obtained the details of 69 naval officers who, it alleged, participated in the seizure of the Gaza flotilla, and offered a cash reward of $100,000 for each of them.

Israeli security officials stress, however, that Handala's primary goal in incidents of this type is not only to cause direct technological damage, but to intimidate and humiliate Israelis. The public is urged to remain vigilant, to avoid scanning unfamiliar materials, and to report immediately to the 100 emergency line any similar attempts.