Hamas hackers tried to 'seduce' Israeli soldiers online by posing as women

The phones of dozens of soldiers were infected in recent months, but major secrets were prevented from leaking

Palestinian fighters with Ezz-Al Din Al-Qassam Brigades, the armed wing of the Hamas movement, rest on a sidewalk during a patrol in Khan Younis in the southern Gaza Strip on January 26, 2020. AFP

Palestine’s Hamas militants have made repeated attempts to hack the phones of Israeli soldiers by disguising themselves as young woman on social media, the Israeli army said on Sunday.

The elaborate hack used a network of fake social media accounts to persuade mostly-young Israeli soldiers to download malware-filled apps.

Lt Col Jonathan Conricus, a spokesman for the Israeli Defense Forces, confirmed that dozens of Israeli soldiers downloaded malware-infected photo-sharing apps, but said the threat was minimal.

He said the Israeli army "does not assess that there has been a substantial breach of information." Mr Conricus said this hack marks the third such attempt in four years by Hamas to infect Israeli soldiers’ phones.

But, this attempt was described as being “more advanced and sophisticated” than previous attempts by the group to intercept Israeli information infrastructure.

"What we are talking about today is more advanced," Mr Conricus said. "They are upping their game."

The Israeli army said they had identified a network of six fraudulent profiles that posed as young women to target Israeli soldiers who had posted photos online of themselves in their military uniform. The accounts were active across Telegram, Facebook, WhatsApp and Instagram.

The Israeli army said it was the first time they detected Telegram being used in a cyber Hamas attack. Hamas has not responded to the allegations.

While the profiles were fake, they had to navigate real human interactions in order to accomplish the hack. Many of the profiles pretended to be new to Israel in order to explain their lack of Hebrew knowledge. While other profiles said they were deaf or hard of hearing in order to block attempts by the soldiers to speak on the phone. The profiles also used Israeli slang and sent generic voice notes of women saying “yes” or “no” in order to dissuade any suspicion.

Another way the group disguised their network was by using profile photos that had been edited in order to bypass reverse-image search, commonly used to identify fraudulent accounts, the Israeli army said.

Increasingly, online bad actors engaging in disinformation campaigns use fake and edited profile photos, sometimes flipping or re-colourising the image in order to fool reverse-image search engines.

The network of fake profiles persuaded Israeli soldiers to download infected photo-sharing apps similar to Snapchat. Three apps that were identified, Catch&See, ZatuApp and GrixyApp, sought to infect the soldiers’ phones with malware that would effectively give the hackers total access to the device. Israel said that after downloading the app, files would automatically be transferred to Hamas servers, and the hackers would be given control of the phone’s camera, microphone, GPS, contacts and text messages, in addition to being given read and write access to the phone’s files.

The apps were not available on any app store and required a link to be downloaded. After download, a message would state the phone was not compatible and the app would self-delete, but the malware remained.

In 2018, Hamas was accused of using a similar technique in order to persuade Israeli soldiers to download malware-filled dating or sports apps.