As Iranian missiles fell on Israel, some people with Android phones received texts offering a link to real-time information about bomb shelters. But instead of providing help, the link downloaded spyware that gave hackers access to the device’s camera, location, and personal data.

This incident, believed to be orchestrated by Iran, shows how cyberattacks are increasingly used alongside physical warfare. Disinformation, artificial intelligence, and hacking have now become key tools in modern conflicts, particularly in situations where one side has fewer military resources.

Coordinated digital attacks

The fake texts were timed to arrive while missile strikes were happening, according to Gil Messing, chief of staff at Check Point Research, a cybersecurity firm with offices in Israel and the United States.

“This was sent to people while they were running to shelters to defend themselves,” Messing said. “The fact it’s synced and at the same minute is a first.”

Even if a ceasefire is reached, experts believe such digital attacks will continue because they are cheaper and easier than conventional warfare. The aim is not to kill or conquer but to spy, steal information, and intimidate.

High volume, low damage

Most cyberattacks linked to the conflict have caused little physical or economic damage. However, they have forced many US and Israeli companies to act quickly to fix old security weaknesses.

Researchers at Utah-based DigiCert tracked nearly 5,800 cyberattacks by around 50 groups linked to Iran. While most attacks targeted US or Israeli companies, networks in Bahrain, Kuwait, Qatar, and other regional countries were also affected.

Although many attacks can be blocked with modern security precautions, older or poorly protected systems can suffer serious problems. There is also a psychological impact on companies working with the military.

“There are a lot more attacks happening that aren’t being reported,” said Michael Smith, DigiCert’s field chief technology officer.

Attention-seeking attacks

Some attacks are designed to be flashy rather than destructive. A pro-Iranian hacking group claimed responsibility for breaching the account of FBI Director Kash Patel, posting old photographs and documents. Most of the material was over a decade old.

“These attacks are a way of showing people in other countries that you can still reach them, even from another continent,” said Smith. “It acts as a form of intimidation.”

Targeting vulnerable areas

Iran often targets weak points in American cybersecurity, including supply chains, critical infrastructure such as ports, rail stations, water plants, hospitals, and data centres.

Recently, Iranian-linked hackers claimed responsibility for an attack on Stryker, a medical technology company in Michigan, reportedly in retaliation for US strikes that killed Iranian schoolchildren. Another healthcare company was hit with ransomware that locked staff out of the system, but no ransom was demanded.

“This suggests a deliberate focus on the medical sector rather than random targets,” said Cynthia Kaiser, senior vice president at cybersecurity firm Halcyon. “As the conflict continues, these attacks may intensify.”

Role of artificial intelligence

Artificial intelligence is being used both to increase the speed and volume of attacks and to automate processes. AI also plays a role in defending against cyberattacks, allowing security teams to respond faster. Director of National Intelligence Tulsi Gabbard told Congress that AI will increasingly improve the speed and effectiveness of cyber operations for both attackers and defenders.

Disinformation and deepfakes

AI has also been used to spread false information online. Supporters of both sides have circulated doctored images of fake atrocities or victories. One deepfake showing sunken US warships received over 100 million views.

In Iran, the government has restricted internet access and used propaganda to shape public perception of the war. State-run media has sometimes labelled real footage as fake and substituted doctored images.

Broader cyber threats

While Russia and China are considered larger cyberthreats, Iran has repeatedly targeted the US in recent years. Iranian-linked groups have attempted to infiltrate Trump’s campaign email systems, attack US water plants, breach military networks, and impersonate American protesters online to encourage unrest against Israel.