Threat reportThreat IntelligenceTL-2026-3820
Houthi/Yemen-linked Influence Campaign Using Fake News Sites and Forged Facebook Personas Targeting Israel and Gulf States
Houthi/Yemen-linked Influence Campaign Using Fake News Sites (TL-2026-3820), also tracked as Houthi Influence Campaign, is a medium-severity tracked intrusion set, first published 2026-10-17. It is linked to a Yemen-nexus actor with low confidence, affects Meta Facebook (pages, personas and community groups abused for content, maps to 6 MITRE ATT&CK techniques (T1036.010, T1566.003, T1583.001), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3820
- Threat ID
- TL-2026-3820
- Also known as
- Houthi Influence Campaign, Yemen-Based Disinformation Campaign
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- Yemen
- Motivation
- UNKNOWN
- Target sectors
- news - media, general-public, government administration
- Target regions
- israel, saudi arabia, united arab emirates, Middle East
- Detection rules
- 9
- Indicators of compromise
- 9
How Houthi/Yemen-linked Influence Campaign Using Fake News Sites works
ClearSky reports a persistent Yemeni/Houthi-linked influence campaign that copies gossip-style content from legitimate Israeli media onto fake websites and reposts it through forged Facebook personas in real Israeli community groups. The campaign focused on Gulf states (Saudi Arabia, UAE) in 2019-2022 and returned to Israel from late 2024. No malware was detected, but the infrastructure could later be used to spread fear-inducing messages or malicious content.
In early April 2025 ClearSky's research team identified a persistent influence campaign attributed, with limited confidence, to Yemeni/Houthi-based operators. ClearSky first exposed the same operation in July 2019, when several social media profiles spread a hoax that two well-known Israeli women, actor Yona Elian and singer Roni Dalumi, had died; the false reports were posted on pages of Israeli media outlets and in marginal Israeli social media groups, mainly on Facebook. The 2019 report described a Yemen-based network operating since 2016 and made up of several dozen fake media outlets impersonating legitimate Arab media outlets in the Gulf and Arabian Peninsula.
The 2025 activity uses the same methodology. Gossip-style articles are copied from legitimate Israeli media and published on fake websites in Hebrew (for Israeli audiences) and Arabic (for Gulf readers); gool-live.com is the example domain cited in secondary coverage. Forged Facebook personas (for example 'Sarah Sarah') and fake pages (for example 'Celebrity News') repost identical messages and clickbait links inside real Israeli community groups such as neighborhood boards and buy/sell groups, including local communities in Be'er Sheva and Ramat Gan, some of which are unrelated to the content. ClearSky linked the campaign to dozens of active domains, some dating back to 2019, registered under aliases and often hosted by Yemen-based providers. One operator-side artifact noted by ClearSky is that the page operator's Facebook interface is set to Arabic.
Between 2019 and 2022 the campaign mainly targeted Gulf countries, particularly Saudi Arabia and the UAE, and it returned to focusing on Israel from late 2024. ClearSky notes that operators have invested for years in the infrastructure, with dedicated personnel, funding and a certain level of Hebrew proficiency. Attribution is described as a possible connection to the Houthi movement, which has strong connections to the Iranian regime; the operation uses the same methodology as the global Iranian disinformation network ClearSky exposed in 2018, but the report does not confirm Iranian involvement.
No malicious code or malware was detected. The risk is influence and psychological manipulation now, and ClearSky warns the infrastructure and audience reach could later be used to spread fear-inducing messages or deliver malicious content. Severity of MEDIUM is analyst judgment given the absence of malware or exploitation. Note: the ClearSky HTML page and PDFs could not be machine-read during research, so details are drawn from ClearSky's published summary as reproduced by secondary sources (SecurityOnline, malware.news, search excerpts).
MITRE ATT&CK techniques used in TL-2026-3820
Defense Evasion
T1036.010 Masquerade Account Name; T1684.001 Impersonation
Initial Access
T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1585.001 Social Media Accounts
Affected products and versions in Houthi/Yemen-linked Influence Campaign Using Fake News Sites
- Meta — Facebook (pages, personas and community groups abused for content distribution)
Remediation for Houthi/Yemen-linked Influence Campaign Using Fake News Sites
Immediate actions
- Report fake Facebook pages and forged personas (e.g. 'Celebrity News', 'Sarah Sarah') to Meta
- Block or sinkhole gool-live.com and related fake news domains at DNS/web proxy
- Administrators of Israeli community Facebook groups: review recent members and remove accounts reposting copied gossip links
Workarounds
- Restrict posting rights and require admin approval for links in community groups
Longer-term hardening
- Monitor for new lookalike media domains and re-use of copied Israeli media content
- Run user awareness training on clickbait and unverified news shared in community groups
- Track the infrastructure for any change from pure content to payload delivery (links, downloads, credential forms)
Timeline of Houthi/Yemen-linked Influence Campaign Using Fake News Sites
- ClearSky's 2019 report dates the Yemen-based network of fake media outlets to 2016 (year only; exact date not stated)
- Times of Israel reports ClearSky's findings on Iran-run fake news sites targeting Israelis, the precedent methodology
- ClearSky exposes a global Iranian disinformation infrastructure whose methodology the Yemen-based campaign later mirrors
- Forged profiles spread false reports of the deaths of Israeli actor Yona Elian and singer Roni Dalumi on Israeli media pages and Facebook groups
- 2019-2022 the campaign focused mainly on Gulf countries, particularly Saudi Arabia and the UAE (year-level source; date marks end of 2022)
- From late 2024 the campaign returns its focus to Israeli audiences, using Hebrew content copied from Israeli media (approximate date)
- ClearSky's team identifies the persistent campaign in early April 2025, including fake Facebook pages and personas posting in Israeli community groups
- SecurityOnline publishes coverage of ClearSky's April 2025 Houthi influence campaign report
Sources cited for Houthi/Yemen-linked Influence Campaign Using Fake News Sites
- Houthi Influence Campaign (ClearSky)
- Houthi Influence Campaign April 2025 (ClearSky PDF)
- Houthi Influence Campaign: Deceptive Tactics on Facebook Target Israel and Gulf States (SecurityOnline)
- Houthi Influence Campaign (malware.news mirror)
- Yemen-Based Disinformation Campaign Distributing Fake News in Israel and the Arab World (ClearSky, 2019)
- Yemen-Based Disinformation Campaign (ClearSky landing page)
- Cyber firm says three Iran-run sites are targeting Israelis with fake news (Times of Israel, related Iranian precedent)
Detection coverage for TL-2026-3820
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3820 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.