Digital fragments unveil online campaign to flip Iranian nuclear scientists

Mysterious online campaign linked to Israel attempted to recruit Iranians to overthrow their government. Some appear placed by an Atlanta-based influencer.

Iranian opposition leader Reza Pahlavi (left) standing next to former Israeli intelligence minister Gila Gamliel (right) in an undated photo shared to the social media platform X on Sunday by the apparent Persian-language account of Benjamin Netanyahu’s digital advisor, Hananya Naftali. The image was implied to relate to Pahlavi’s proposed “Cyrus Accords” peace treaty with Israel. Pahlavi was part of a “post-regime” delegation to Israel that met with Gamliel in the last week.

Updated with a new, fifth Mossad recruitment ad, which was served in Germany following this article’s publication.

Desi Banks, an Atlanta comedian and content creator, is known for his light-hearted comic sketches and currently has more than nine million followers on the social media platform Instagram. There is no public record of Banks commenting on sensitive Middle East issues, and each of his ad campaigns on Meta’s platforms relates to his work as an entertainer.

The comedian, who did not respond to repeated requests for comment, seems to have served a surprising role in an apparent Israeli intelligence operation over the last year to recruit members of Iran’s security and intelligence services – including those working in nuclear centers – into aiding the overthrow of their government. Would-be defectors were offered both money and the protection of their families.

Google advertising transparency records show that a production company owned by Banks, Desi Banks Productions LLC, served a set of five Persian-language recruitment ads across at least 19 countries, including the U.S., Sweden, France, Germany, India, and numerous others across the Middle East and Africa.

The five ad campaigns have included both overt and deceptive redirections into recruitment pages purporting to be run by Israel’s foreign intelligence services, the Mossad. Others advertise lucrative, tax-free jobs at apparently fictitious international consulting firms.

The most aggressive campaign redirected users to the Mossad’s official, Persian-language recruitment form during the recent 12-day war between Israel and Iran, advising viewers to activate their virtual private network (VPN) before clicking. According to Google’s ad disclosure portal, this campaign was the sole instance of a Google ad directly linking to the Mossad’s official website, mossad.gov.il.

Germany-based family members of Iranian nuclear engineers appear to be a major focus of the effort, as Germany is the only country identified by the Google ad transparency portal as being targeted with all five ad campaigns.

Following publication of this article, Google’s ad transparency portal disclosed a fifth Mossad recruitment ad being served through Desi Banks Productions as recently as Monday. So far, the ad has only been disclosed as being served in Germany.

"You are just one click away from making history," read the first direct Mossad recruitment ad, captioned atop a darkened cartoon of a man walking down a multi-lane road. "Call Now. The future belongs to you."

This call to espionage was targeted to viewers in at least 18 countries, including the United States.

Another of the international recruitment campaigns used an image of an infant to lure viewers into a Google recruitment form which encourages Iranians to help overthrow their current government. According to Google’s ad transparency portal, the ad was last served on June 7, a week prior to the onset of the 12-day war.

"If you care about your child's future, watch this video,” read the banner text of the image of the infant, bringing its viewers into the Google recruitment form instead of playing the promised video when clicked. “Sometimes a click is the start of a transformation,” the ad foreshadowed.

"The last days of the regime are near," declared the Farsi Google recruitment form payload. "Today is the time to act. It would be a betrayal of Iran not to take action at this crucial moment. Do not be fooled by the regime's nationalist messages."

Decorated with the crossed flags of Iran and Israel, the sign-up page cautioned potential recruits to understand that, while they "may think this is a trap," they would be protected by security measures and rewarded with "numerous other benefits” which would be shared through “direct communication.”

A recent banner image from Blue Message’s central Google recruitment form. The image was replaced with an understated analogue earlier this month.

“To get started, just send us an anonymous Gmail address ✉️ via the form below,” read the emoji-laden text. “📩 Next, within a few days, you will receive an email from us that will fully explain the next steps,” it continued.

The Google form further beckoned those in Iran and the Iranian diaspora to sign up for the primary Telegram channel of the campaign, @bluemessageofficial, which currently has more than 2,200 subscribers. Prior to centralizing on a Google submission form, the “Blue Message” campaign encouraged defecting members of Iran’s security services to upload their biographies through the now-defunct website payameabi.com, whose URL was derived from the Romanized Persian translation of “Blue Message.”

“Blue Message is a recruitment center for esteemed personnel and employees of Iranian security and intelligence agencies,” read an early-April cache of the website. “We assure you that if you or one of your family members work in nuclear centers or power plants, you can cooperate with us with a high security factor,” stated the Blue Message website, adding that, “All you have to do is contact us through the secure form.”

The highest production value propaganda was published to the Blue Message Telegram and X accounts on January 28, in the form of an artistic, nearly two-minute portrayal of an Iranian nuclear engineer named Amir deciding to defect to Israel to give his newborn child a better life. “I am waiting for your call,” the engineer cried out to the Israeli government, after sending his defection message “into the heart of Tel Aviv.”

A composite of three images from a video published by the “Blue Message” campaign on January 28, depicting an Iranian nuclear engineer named Amir defecting to Israel to give his newborn child a better life.

Numerous X accounts parodied Amir’s description of his defection request, posting images of Iranian missiles ready to reach into “the heart of Tel Aviv.” Another X user replied that the video was a “Classic honeypot.”

Subsequent animations published by Blue Message during the 12-day war between Israel and Iran in June were less sophisticated. “Betrayal means forgetting what they did with the women of your country for 47 years,” read one of the three messages, alongside an animated photo of an Iranian woman. “Now is the right time to join us,” continued the call for defection, before linking to the central Google recruitment form, alongside a hashtag for Operation Rising Lion.

The Persian Blue Message X account went a step further on June 18, replying to its own posting of the animation with a message stating that “individuals who intend to collaborate” could, due to “special circumstances,” directly make use of the Mossad’s Persian-language contact form.

Blue Message the same day reshared a video posted by the apparent Persian-language account of Netanyahu digital advisor Hananya Naftali, which promised friendship between Israel and the people of Iran. The same account served as an outlet for Israeli military propaganda during Rising Lion and has, in recent days, promoted Iranian opposition leader Reza Pahlavi’s proposed “Cyrus Accords” with Israel. Pictures of Pahlavi standing next to former Israeli intelligence minister Gila Gamliel — the current minister of science and technology — were widely shared from of a “post-regime” delegation which arrived in Israel earlier this month.

Perhaps the only previous reporting on the “Blue Message” campaign came in January from Al Manar, the news agency of the Lebanese political party and paramilitary group Hezbollah. Referring to the campaign’s X account as engaging in “Israeli Cyberwarfare,” the news agency wrote that, “This account is managed by Israeli intelligence with the aim of recruiting agents, and its center is Tel Aviv.” (Blue Message’s Arabic-language X account, @risalazarqa, has focused on recruitment in Lebanon.)

A Persian post in late July from the X account @Its_Ali_IR similarly provided a “serious warning” that, “The account below [@payameabi], with a Mossad link and Google form, is collecting information and inviting betrayal.” The previous day, X’s affiliated large language model, Grok, concluded that “This account (payameabi) appears to be part of an Israeli (Mossad) information campaign to invite Iranians to cooperate against the Islamic Republic regime.”

Numerous other accounts on X have expressed skepticism that Blue Message is affiliated with the Israeli government, suggesting that it could be a counterintelligence operation run by Iran.

But Blue Message would not be the first Israeli psychological warfare effort attempting to instigate a coup d'etat in Iran. The Washington Post obtained an audio recording of an Israeli operative threatening an Iranian general on June 13, at the start of Israel’s 12-day war with Iran. “I can advise you now, you have 12 hours to escape with your wife and child. Otherwise, you’re on our list right now,” the operative said, pressing the general to make a video denouncing the Iranian government.

“Hello dear Iranians everywhere in beautiful Iran!” opened the Telegram channel’s first message, on June 7, 2024, before providing detailed advice on how to request cooperation with the Israeli government through the same Google form.

“For greater security, it is recommended that loved ones who are in Iran activate their VPN before clicking on the form link,” continued the message.

Beyond the ever-challenging question of attribution, the effectiveness of the Blue Message campaign is also uncertain. The most recent post to the campaign’s Telegram channel, on July 15, provided subscribers with the “anonymous quiz” question of, “How many people do you think contacted us through the Blue Message campaign and secure form since the war?”

While the answer to the quiz question was not provided, Telegram showed that the question was viewed 804 times, receiving 117 answers.

A similar poll posted to X in October concluded with the embarrassing majority response that “no one” had contacted Blue Message. The poll’s replies were similarly filled with Persian insults, including that the Israel-allied campaign was wasting its money and that, “Israelis are child killers.”

Correction: The English translation of the direct Mossad recruitment ad was corrected from “one day away” to “one click away.”