In October 2023, Yemen’s Ansarallah-aligned armed forces joined the battle in support of the Palestinian resistance's Al-Aqsa Flood operation, and against Israel's war on Gaza. Today, nearly two years on, a new battlefield has surfaced – far from the waters of the Red Sea or the skies of occupied Palestine. 

This war does not involve drones or ballistic missiles. It is a silent, persistent, and digital invasion aimed at prying open the Sanaa government’s internal cohesion through espionage, psychological manipulation, and soft-penetration tactics.

Phone calls from the occupation state 

The covert war began subtly. Mahmoud, a Yemeni journalist working with a local broadcaster, received a message from an unfamiliar international number. But what caught his attention was not just the unfamiliar digits, but the country listed beneath them: “Israel.”

“It was terrifying,” Mahmoud tells The Cradle. “The sender greeted me by my full name, praised my media work, then invited me to join their team. I immediately deleted the conversation before they could say more.”

Mahmoud’s case is not unique. Sami, a resident of Sanaa, received a different message with the same pattern. A Facebook account claiming to be a Palestinian doctor invited him to join an “academic discussion” with a Yemeni expert. It included names of well-known Yemenis who supposedly recommended him. Sensing something off, Sami reached out to those named, yet none of them knew anything about the event.

According to corroborated testimonies gathered by The Cradle from journalists and activists across Yemen, these approaches are part of a rapidly expanding campaign of Israeli and American cyber-infiltration and recruitment. 

The covert intel efforts escalated rapidly after 7 October 2023, when Yemen joined the battle in direct military support of Gaza, prompting Tel Aviv and Washington to zero in on Sanaa as a priority intelligence target.

The intelligence vacuum

Yemen’s drone and missile strikes rattled Israeli shipping lanes, and also struck deep inside the occupied state, targeting key military and economic infrastructure, penetrating as far as Ben Gurion Airport. That unanticipated resistance front exposed what Israeli security elites later admitted was a significant intelligence void.

“Israel has many years of familiarity with those enemies [Iran, Hezbollah, and Hamas]. There is intelligence and there is the important element of a ground maneuver, and in Yemen we can’t do that. The scale here is different,” Eyal Pinko, a former Israeli defense official and senior research fellow at the Begin-Sadat Center for Strategic Studies – an Israeli think tank – was quoted as saying. 

Until 18 November 2023, neither Mossad nor the military intelligence unit Aman had prioritized penetration and information gathering activities in Yemen. But after sustained attacks from Sanaa, internal Israeli discussions shifted. Calls emerged for “intelligence openness” toward Yemen to narrow the margin of surprise.

Former Israeli war minister Avigdor Lieberman publicly called for establishing intelligence pathways inside Yemen, including support for local proxy forces to undermine Ansarallah. Likewise, former National Security advisor Yaakov Amidror admitted Tel Aviv’s security apparatus had fundamentally misunderstood Yemen and Ansarallah’s strategic calculus.

The shift came too late. Sanaa had already disrupted Israel’s deterrence doctrine and forced a broader, frantic expansion of its intelligence footprint.

Targeting Yemenis online 

Amid Israel’s intelligence vacuum on Yemen, Tel Aviv began compensating through complex infiltration and espionage operations. A security source tells The Cradle that “recruitment efforts start with seeking out Yemeni Jews fluent in the Sanaa dialect or other local tongues, aiming to use them as agents to gather intelligence from inside the country.”

In addition, the source highlights another growing method: mass online advertisements. These appear while browsing social media and often promise financial rewards – up to a million dollars – or information leading to Ansarallah figures or data linked to “naval support operations.” 

Some ads originate from suspicious Mossad-affiliated pages, but others come from official US pages like the Department of the Treasury or the US Embassy, under the guise of “protecting maritime interests” or ensuring global navigation security.

“The goal,” the security source says, “is to collect intelligence on specific areas or targets related to the active naval front – anything connected to Sanaa’s military strength in the Red Sea arena.”

He reveals that some arrested spies have received advanced intelligence training in European countries and returned to Yemen under the cover of international organizations, media outlets, or development agencies. This provided them with broad movement capabilities that are difficult to monitor under normal circumstances.

Their primary tasks included monitoring sensitive military sites, gathering detailed intelligence on naval forces, and collecting technical and operational data on missiles and drones. They also carried out sabotage and assassination operations, transmitted coordinates to facilitate airstrikes, and used encrypted devices, advanced spyware, and satellite communication systems that were difficult to trace by traditional means.

These operations form part of a systematic strategy to infiltrate Yemen through organizations that outwardly appear to focus on development and cooperation, but in reality function as espionage and sabotage arms across economic, agricultural, educational, and security sectors. 

The networks operate under various covers – diplomatic, humanitarian, economic, and academic – serving the intelligence interests of the CIA and Mossad.

In recent years, suspicious activity has surged in the media sector. Operating under attractive slogans, these efforts mask more dangerous agendas. Journalists describe repeated targeting patterns: NGOs and cultural institutions, workshops in closed hotel venues, surveys asking suspicious questions about political affiliations, post-session invitations for private follow-ups, and informal offers to fund directed investigations. 

Some even received travel invitations or proposals to join international media projects – only to later discover they served foreign agendas.

Most of these initiatives were funded by US-linked entities, often channeled through intermediary countries, embassies, or regional cultural arms. One group, operating under the name “Labs,” was exposed by Yemeni intelligence for conducting direct espionage operations while posing as a development media outfit.

Espionage in broad daylight

The infiltration techniques uncovered by The Cradle follow a disturbingly consistent script. Yemenis report receiving unsolicited messages from foreign numbers – often marked with Israeli or European country codes – offering lucrative jobs in media or NGOs. 

These messages frequently impersonate academics or professionals, cite well-known local figures to build trust, and probe for granular information about sensitive locations, community leaders, and military infrastructure. 

Abdulrahman, a journalist in Sanaa, recalls receiving messages from accounts mimicking friends or colleagues on Facebook. “It started with private messages from accounts bearing familiar names – sometimes with profile photos of friends or colleagues. But when I checked the accounts, they were new, with barely any posts.”

One account asked for sensitive information about a colleague; another tried to lure him into a political debate before dropping a suspicious link. “What’s worse,” he says, “is that some of these accounts used identical language – like they were managed by the same source. And the use of real names and photos made the deception even harder to detect.”

Sultan al-Samie, member of Ansarallah’s Political Council, confirms that youth are being targeted en masse. He shares with The Cradle the story of a young man from Sanaa who admitted to working with Mossad after the agency exploited his family’s poverty by being offered $250 to install a covert camera app and document his neighborhood – its streets, alleys, supervisors, and local officials:

“The tasks were divided among groups, each containing around 94 people. With each assignment, the payments increased – $300, then $600, and eventually larger sums for more precise images and footage.”

Samie warns that Mossad has already successfully recruited several young men and women over the past few months.

In one secret case reviewed by The Cradle, journalists were asked to provide detailed reports on Sanaa’s politically sensitive Sabeen Square – a frequent physical target of Israeli airstrikes. They were tasked with photographing checkpoints, documenting building uses, and evaluating telecom infrastructure.

The data war enters the home

Beyond spies and covert photography, a more silent and systemic breach is unfolding. Abdelhafidh Muajeb, a specialist in psychological warfare, identifies two dangerous entry points: undocumented African laborers and the proliferation of unregulated delivery platforms.

He explains that many of these workers entered Yemen unofficially and are now employed in sensitive spaces – hotels frequented by officials or inside government buildings – where they can access critical infrastructure without scrutiny.

Equally troubling, Muajeb says, is the unchecked rise of delivery apps across Yemen’s cities. These platforms, often lacking clear legal status or known ownership, have embedded themselves into daily life, collecting detailed personal data: household addresses, family demographics, consumption patterns, and even meal preferences:

“These companies operate under the radar, expanding through digital discounts and promotions with no oversight from the transport or telecommunications ministries. The danger lies in the questions no one is answering: Who collects this data, where is it stored, and whose hands does it end up in?”

Samie echoes this warning. He says the intelligence war is shifting to new, more insidious tactics. Unregulated migrant labor and delivery apps now complement digital deception operations that recruit Yemenis through fake job ads, European and American numbers, and social engineering schemes – all of which serve hostile intelligence agencies.

Spy networks dismantled 

According to Sanaa’s security agencies, between 2015 and March 2024, more than 1,782 spy cells were dismantled and 25,665 individuals arrested for foreign intelligence collaboration. In January 2025, authorities revealed the arrest of a spy ring working for British MI6 and Saudi intelligence, aimed at sabotaging Yemen’s support for Gaza. 

Days earlier, a joint CIA-Mossad cell was captured in Saada, targeting drone facilities and command centers. The most significant operation came in May 2024 with the dismantling of “Unit 400,” a US-Israeli spy network operating on Yemen’s western coast. 

Its mission: penetrate internal defenses and locate missile launch and command sites. Its destruction dealt a heavy blow to Washington and Tel Aviv’s airstrike precision. 

A code of silence 

Yemen now finds itself in a different kind of war – one waged through whispers, apps, NGOs, and fake job ads. Washington and Tel Aviv are attempting to breach the social fabric and media space of a country that has, until recently, been written off as a peripheral player. 

But conventional threats are also accelerating. On 23 July, Israel's Channel 14 reported that the occupation military is preparing what it calls a “major offensive” against Yemen, awaiting a green light from the Israeli political echelon. According to the report, Tel Aviv's security establishment is “working around the clock on a major offensive plan” against the Sanaa government. 

Yet, Yemen continues to shape regional balances – and the resistance it inspires is not only military. It is cultural, informational, and rooted in a society that has proven difficult to map, penetrate, or predict. 

In response to these layered threats, Sanaa's Ministry of Information launched a public awareness campaign titled “Midri” – Yemeni slang for “I don't know” – across platforms like Telegram, X, Facebook, and Instagram. 

The campaign urges citizens not to disclose sensitive information online. One dedicated account regularly posts videos warning against phone tapping, phishing, and the risks of satellite services like Starlink, which officials claim could be exploited by hostile militaries.

What began as a common phrase has since become a cybersecurity doctrine and a pillar of Yemen’s sovereignty campaign. In a country where ambiguity is armor and evasion a survival instinct, Midri is no longer a passive response. 

It is a deliberate act of resistance, shielding Yemen’s social fabric from hostile encroachment and asserting that its internal front is neither exposed nor for sale.