State secret, friendly price. Since Wednesday, a Telegram channel has been broadcasting videos presented as being filmed in the military helicopter of Benjamin Netanyahu, Prime Minister of Israel and candidate for his re-election on October 27, as well as photos from inside his official plane. Its administrators are demanding $1,011 in bitcoin for the first batch.
This channel claims to have hacked the phones of Yossi Shelley, former director of the Prime Minister's Office who became Israeli ambassador to the United Arab Emirates, and Sara Netanyahu, the wife of the head of government. No Israeli media had picked up the information on Thursday morning, in a country yet accustomed to cyberwar with Iran.
Key Points
According to an X cyber monitoring account, a Telegram channel publishes images presented as being shot in the helicopter and the official plane of the Israeli Prime Minister.
It requires the equivalent of $1,011 in bitcoin for an initial batch of files.
The phones of Yossi Shelley and Sara Netanyahu would be targeted, without any official confirmation.
The method is reminiscent of that of Handala, a group of hackers linked to Iranian intelligence which has already targeted former Prime Minister Naftali Bennett.
Netanyahu leak: what the channel published
The alert came from the International Cyber Digest account, an X account for cybersecurity monitoring without identified editorial staff, which relays captures of Telegram channels without its own verification. His post was viewed 2.8 million times in just a few hours. As of Thursday morning, no leading Israeli media or cybersecurity publisher had picked it up. According to this relay, the channel broadcast videos which would have been filmed aboard a military helicopter transporting the Prime Minister. He also published what he said were photos of the interior of the Wing of Zion, the Boeing 767 that serves as Israel's Air Force One. There is a secure internal telephone.
The price is surprising. $1,011 is approximately 0.0125 BTC as of Thursday morning. For images taken at the heart of the Israeli security apparatus, the sum is more a provocation than an economic model. The channel promises other publications.
As of Thursday morning, neither the Prime Minister's office nor the ambassador had reacted publicly. No Israeli authority has authenticated the images at this stage.
Several gray areas remain. There is nothing to date the images, nor to establish that they come from the phones mentioned: they could just as easily come from an email account of the entourage, or even from files already in circulation. The paltry sum and the electoral calendar are more reminiscent of a destabilization operation than of real extortion.
Handala, Telegram and the Bennett precedent
The channel does not sign. However, its method is reminiscent of that of Handala, a group that the cybersecurity publisher KELA links to the ecosystem of the Iranian Ministry of Intelligence. In December 2025, Handala claimed responsibility for hacking the iPhone of Naftali Bennett, former prime minister and Netanyahu's campaign rival, then that of the phone of Tzachi Braverman, Netanyahu's chief of staff. The Prime Minister's office denied any intrusion. Bennett ended up admitting the hacking of his Telegram account, ensuring that the device remained healthy.
For KELA, these attacks target email accounts rather than phones. Hackers obtain login codes through phishing or steal Telegram Desktop session files from a compromised computer. The editor also considered the extent of the Bennett leak to be exaggerated, with only around forty conversations containing real messages.
Twelve days before the election, a campaign undermined by leaks
The timetable is bad for the Prime Minister. Israelis vote on October 27 to renew the Knesset, the Parliament, and Netanyahu's entourage continues to fail. At the end of September, Calcalist revealed that Jonatan Urich, close advisor to the head of government, had linked his personal WhatsApp account to Ultramsg, a messaging management service which presents itself as based in the United Arab Emirates. His messages were leaked on October 11 and, according to Haaretz, the Shin Bet, Israel's internal security service, is reviewing the leaked data.
