Iran’s Fake “Shelter Danger” Calls Part of Psychological Cyber Warfare Playbook

Why It Matters

The deception can undermine civilian compliance with real emergency warnings, amplifying the lethality of kinetic attacks and exposing a new front in hybrid warfare.

Key Takeaways

• Iran spoofed Israeli emergency numbers to sow panic
• Calls instructed citizens to avoid shelters during real attacks
• Spoofed texts mimicked official OREFAlert rocket warnings
• Cyber attacks surged 700% in first two conflict days
• Israeli authorities urge verification via official apps and sites

Pulse Analysis

Caller‑ID spoofing has become a low‑cost weapon in the Israel‑Iran conflict, allowing hostile actors to masquerade as the Home Front Command, the body that issues life‑saving missile alerts. By delivering automated voice messages that tell residents to avoid shelters or expect fuel shortages, the attackers aim to erode trust in official warnings. When civilians hesitate during an actual strike, the physical damage multiplies, turning a conventional missile into a psychological force multiplier. This tactic demonstrates how adversaries can weaponize ordinary communication channels without breaching any network perimeter.

The spoofing campaign is part of a larger Iranian playbook that blends cyber intrusions with cognitive attacks. Radware reported a 700 % spike in cyber incidents against Israeli targets within the first two days of the latest escalation, while Check Point documented thousands of threatening emails aimed at universities and hospitals in 2025. These operations combine DDoS floods, data theft, and malware with disinformation, creating a multi‑vector pressure on both digital and physical domains.

For security teams, the most critical vulnerability is no longer a firewall but the split‑second decision of a civilian under alarm. Israeli officials now urge the public to rely exclusively on the Home Front Command’s official mobile app, website and verified social media accounts, and to report suspicious calls immediately. This guidance underscores a broader lesson for any nation facing hybrid threats: authentication of emergency communications must be hardened, and public awareness campaigns should teach citizens to verify alerts before acting. As adversaries refine spoofing tools and integrate them with larger cyber offensives, organizations worldwide must incorporate cognitive‑risk assessments into their security strategies to protect both infrastructure and the human element.