Israeli air force drops leaflets with QR code over Beirut, authorities warn against scanning

The Israeli air force dropped thousands of anti-Hezbollah leaflets over Beirut, including in Hamra district, local witnesses told L'Orient Today Friday.

While Israel has repeatedly used leaflets in southern Lebanon, this marks the first time in two years such materials have been distributed over the Lebanese capital.

The leaflets addressed to "Lebanese people” call for Hezbollah’s disarmament, labeling the group “Iran’s shield.” Several loud detonations were heard across Beirut neighborhoods as the leaflets were dropped.

One of the leaflets reads: "Lebanon is your decision, not someone else’s. Stability isn't just a word. It is the right of every Lebanese.Unit 504 of the Israeli army is working to ensure the future of Lebanon and its people, believing in the principle 'if your neighbor is well, you are well. If you want to be part of real change and contribute to the prosperity and protection of your country we are here to listen to you,” followed by two QR codes.

The Lebanese immediately warned citizens against scanning the QR codes printed on leaflets dropped by the Israeli air force over Beirut.

In a statement, the army said the leaflets contain “a QR code linking to a WhatsApp contact and another to a Facebook page to communicate with Unit 504 of the Israeli army, which is responsible for recruiting agents.”

The army command “cautions citizens about the danger of scanning these codes and accessing these links,” citing “legal liabilities and security risks,” as well as the potential for “hacking of mobile phones and access to personal data.”

Cybersecurity expert Majd Dhaini told L’Orient Today Friday that “this is not a phishing campaign by a random cybercriminal. The leaflets were dropped by the Israeli military, which operates within the same intelligence ecosystem that produced Pegasus, a commercial spyware tool built entirely on zero-day exploits that silently compromised iPhones and Android devices belonging to journalists, lawyers, and activists worldwide."

Dhaini continued that a “QR code is not malware by itself. But scanning one from an unknown source can expose your identity, redirect you to phishing pages, trigger silent actions inside your apps, or in documented cases, exploit the scanning software itself. When the source is a military intelligence unit from a country with proven zero-day capabilities, operating in an active conflict zone, the Lebanese Army's warning is not political caution. It is technically precise. A QR code dropped over a city by a military intelligence unit from the same country that built Pegasus is not a marketing flyer. Don't scan it!”

For its part, Lebanese digital rights organization SMEX said in a statement Friday that "Israeli aircraft have dropped leaflets containing QR codes, inviting Lebanese citizens to scan them and communicate with the Israeli army via Facebook and WhatsApp.We urge all citizens and residents in Lebanese territory to completely refrain from scanning these codes or accessing any links or channels mentioned in these leaflets, due to the serious risks this poses to your security and safety."

The 1955 Lebanese law on the boycott of Israel prohibits all interaction between Lebanese and Israelis. It forbids any individual or entity from contacting Israelis or persons residing in Israel, and prohibits all commercial, financial, or other transactions. The penalty for violating this law is three to ten years of forced labor.

The dropping of leaflets by the Israeli army is part of a psychological warfare strategy aimed at influencing the morale and behavior of civilian populations. This type of tactic has already been used by Israel in previous conflicts in Lebanon and Gaza.