# Houthi/Yemen-linked Influence Campaign Using Fake News Sites and Forged Facebook Personas Targeting Israel and Gulf States

> ClearSky reports a persistent Yemeni/Houthi-linked influence campaign that copies gossip-style content from legitimate Israeli media onto fake websites and reposts it through forged Facebook personas in real Israeli community groups. The campaign focused on Gulf states (Saudi Arabia, UAE) in 2019-2022 and returned to Israel from late 2024. No malware was detected, but the infrastructure could later be used to spread fear-inducing messages or malicious content.

- **Published:** 2026-10-17T16:05:22Z
- **Last reviewed:** 2026-10-17T16:05:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3820
- **ID:** TL-2026-3820
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In early April 2025 ClearSky's research team identified a persistent influence campaign attributed, with limited confidence, to Yemeni/Houthi-based operators. ClearSky first exposed the same operation in July 2019, when several social media profiles spread a hoax that two well-known Israeli women, actor Yona Elian and singer Roni Dalumi, had died; the false reports were posted on pages of Israeli media outlets and in marginal Israeli social media groups, mainly on Facebook. The 2019 report described a Yemen-based network operating since 2016 and made up of several dozen fake media outlets impersonating legitimate Arab media outlets in the Gulf and Arabian Peninsula.

The 2025 activity uses the same methodology. Gossip-style articles are copied from legitimate Israeli media and published on fake websites in Hebrew (for Israeli audiences) and Arabic (for Gulf readers); gool-live.com is the example domain cited in secondary coverage. Forged Facebook personas (for example 'Sarah Sarah') and fake pages (for example 'Celebrity News') repost identical messages and clickbait links inside real Israeli community groups such as neighborhood boards and buy/sell groups, including local communities in Be'er Sheva and Ramat Gan, some of which are unrelated to the content. ClearSky linked the campaign to dozens of active domains, some dating back to 2019, registered under aliases and often hosted by Yemen-based providers. One operator-side artifact noted by ClearSky is that the page operator's Facebook interface is set to Arabic.

Between 2019 and 2022 the campaign mainly targeted Gulf countries, particularly Saudi Arabia and the UAE, and it returned to focusing on Israel from late 2024. ClearSky notes that operators have invested for years in the infrastructure, with dedicated personnel, funding and a certain level of Hebrew proficiency. Attribution is described as a possible connection to the Houthi movement, which has strong connections to the Iranian regime; the operation uses the same methodology as the global Iranian disinformation network ClearSky exposed in 2018, but the report does not confirm Iranian involvement.

No malicious code or malware was detected. The risk is influence and psychological manipulation now, and ClearSky warns the infrastructure and audience reach could later be used to spread fear-inducing messages or deliver malicious content. Severity of MEDIUM is analyst judgment given the absence of malware or exploitation. Note: the ClearSky HTML page and PDFs could not be machine-read during research, so details are drawn from ClearSky's published summary as reproduced by secondary sources (SecurityOnline, malware.news, search excerpts).

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1684.001 Impersonation
- T1036.010 Masquerade Account Name
- T1566.003 Spearphishing via Service

## Sources

- [Houthi Influence Campaign (ClearSky)](https://www.clearskysec.com/houthi-influence-campaign/)
- [Houthi Influence Campaign April 2025 (ClearSky PDF)](https://clearskysec.com/wp-content/uploads/2025/04/Houthi-Influence-Campaign-april-2025.pdf)
- [Houthi Influence Campaign: Deceptive Tactics on Facebook Target Israel and Gulf States (SecurityOnline)](https://securityonline.info/houthi-influence-campaign-deceptive-tactics-on-facebook-target-israel-and-gulf-states/)
- [Houthi Influence Campaign (malware.news mirror)](https://malware.news/t/houthi-influence-campaign/93049)
- [Yemen-Based Disinformation Campaign Distributing Fake News in Israel and the Arab World (ClearSky, 2019)](https://clearskysec.com/wp-content/uploads/2019/07/Yemen-Based-Disinformation-Campaign-Distributing-Fake-News-in-Israel-and-the-Arab-World.pdf)
- [Yemen-Based Disinformation Campaign (ClearSky landing page)](https://www.clearskysec.com/yemen-disinformation-campaign/)
- [Cyber firm says three Iran-run sites are targeting Israelis with fake news (Times of Israel, related Iranian precedent)](https://www.timesofisrael.com/cyber-firm-says-iran-run-sites-target-israelis-with-fake-news/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3820