Police and Shin Bet probe Handala-linked threat leaflets in north Tel Aviv

Israeli police and the Shin Bet, the country's domestic security service, have opened an investigation into leaflets left in mailboxes at several locations in north Tel Aviv. According to News.co.il, the leaflets were attributed to a group called Handala and carried a QR code that sent anyone who scanned it to a page with threatening content. Officers from the police's Yarkon district went to the sites, carried out searches and gathered material as part of their effort to establish how the leaflets came to be distributed.

The Times of Israel reported that police described the linked webpage as containing "threatening content," and that a screenshot released by police shows the site carrying the title "warning from handala team." Police have asked members of the public who come across similar leaflets to report them straight away to the 100 emergency line, and the inquiry is continuing.

What the webpage said

The Times of Israel described the site's message as written in broken Hebrew. In it, Israelis are warned that if their leaders again strike what the text calls the energy infrastructure of the "resistance front," they should expect to pay a heavy price for that act. The phrase "resistance front" is the language Iran and its allied armed groups use to describe their own alliance, which places the message within that camp's framing.

Reports differ slightly on what the threat covered. The Jerusalem Post headlined its report as concerning leaflets threatening Israel's energy and water sites, while Israel Hayom described a message threatening harm to infrastructure in general terms. The text quoted by The Times of Israel refers to energy infrastructure; the excerpts available here do not show the reference to water.

Who is Handala

The Times of Israel characterised Handala as a hacker group linked to Iran that has in the past published material taken from devices belonging to Israeli officials. Its caption on the police screenshot was careful, describing the page as a website claiming to be run by the group rather than one confirmed to belong to it.

The outlets used different degrees of certainty about the link. Ynet said the leaflets were distributed allegedly on behalf of the hacker group. The Times of Israel said the leaflets appeared to be tied to it, and police believe they are connected to an Iranian-linked group. Television channel N12, citing its reporter Yulan Cohen, went further, reporting that Handala had claimed responsibility for the threatening leaflets in Tel Aviv. Commentator Amit Segal wrote that the Shin Bet's involvement reflected a suspicion that Iranians had placed many propaganda leaflets in north Tel Aviv mailboxes.

Why the Shin Bet is involved

Routine reports of suspicious material in a city are normally handled by the Israel Police alone. The Shin Bet, also known as the Israel Security Agency, is responsible for counter-terrorism and counter-espionage inside Israel, and its participation signals that investigators are treating the possibility of a foreign state actor seriously. In recent years Israeli authorities have repeatedly warned about Iranian attempts to reach Israelis directly, whether through hacking, online messaging or recruitment of local people to carry out tasks on Iran's behalf.

A physical leaflet with a QR code is a hybrid of those approaches: the paper itself carries little, while the code directs readers to online content controlled by whoever produced it. That is why police were interested both in the paper leaflets found on the ground and in the webpage they pointed to.

The Yarkon district

The Israel Police is divided into regional districts, and the Yarkon district is the unit whose officers responded in this case, according to News.co.il. Its officers handled the field work: searching the locations where leaflets were found and collecting evidence.

What the reports do not say

None of the reports say how many leaflets were found, at exactly which addresses or streets, or when they were placed in mailboxes. Nobody has reported who physically delivered them, whether anyone has been questioned or detained, or whether the distribution was carried out by people inside Israel acting for others. The claim of responsibility reported by N12 has not been described in detail, and police had not, in the material available, confirmed that Handala is behind the leaflets. No Iranian response has been reported.