Handala’s Bibi Gate Dump Hits Tzachi Braverman’s Contacts While the PMO Says the Phone Itself May Still Be Intact

Handala branded the campaign Bibi Gate and said it had Tzachi Braverman’s phone. What it published on December 28, 2025, looked like photographs, office paper, and a contact book. Israel’s Prime Minister’s Office answered with a narrow sentence: no indications, at that stage, that the mobile itself was compromised, investigation continuing. Both things can be true. A contact list can leak from a backup, a paired device, or a staffer’s cloud without the chief of staff’s handset falling. That distinction is the story. Headlines said phone hack. The PMO said device status unknown-to-clean. Haaretz’s January 7, 2026, reconstruction treated the leaked numbers around Braverman, former Prime Minister Naftali Bennett, and former justice minister Ayelet Shaked as a real mapping wound — leaders, security officials, even foreign names — whether or not Braverman’s personal iPhone was the hole.

The companion piece on this site is the earlier flight warning Handala posted as Netanyahu packed for Mar-a-Lago. The AEGIS Alliance is treating the two drops as one campaign with two products: a travel scare and a directory.

What the group posted, and what it only promised

Handala’s X account framed the dump as “The Gatekeeper’s Fall.” The copy told Netanyahu’s inner circle that every layer of their security had already failed. It offered a teaser: should we release 110 pages of Braverman’s contacts on the first night. It claimed instant messages, email, and proof of “vile financial and moral acts,” including extortion and bribery. Calcalist, reading the first batch, said the files showed less of that alleged misconduct than the caption advertised. i24, Israel Hayom, and Ynet all carried the claim the same day and all noted that the Prime Minister’s Office was not conceding a handset compromise.

Braverman was not a random aide. He controlled access to the prime minister and had just been approved as ambassador-designate to the United Kingdom. A book like that is a directory of who can reach Netanyahu and who sits one hop off that desk. The Jerusalem Post ran the denial. Other desks ran the screenshots. Neither is a forensic lab. The public still does not have a chain-of-custody letter that says “this file came off this IMEI at this hour.” What the public does have is a magazine-length reconstruction from Haaretz that treated thousands of leaked numbers as a security event even while official Israel argued about which gadget had actually been touched.

Nine days after the December 28 post, Haaretz described an Iran-backed hack-and-leak operation that had reached phones or accounts around Braverman, Bennett, and Shaked and had produced contact lists that included Israeli security officials and world leaders. The Braverman book alone, in that account, ran to roughly 2,400 contacts. That is not a prank PDF. That is a targeting spreadsheet. Whether the hole was an iPhone 16 Pro Max, a Telegram session, iCloud, or a staff laptop is a secondary question once the numbers are in the wild.

Bennett, Shaked, and the week after Bibi Gate

The Braverman claim did not arrive alone. On December 18 Handala said it had Bennett’s phone and published chat messages plus a 141-page contact list. Bennett’s answer was specific: only Telegram, not the handset. On January 3, 2026, the group posted about 60 photos and videos it attributed to Shaked. On January 8 it claimed it had surveilled a senior Mossad officer tied to covert work in Iran and released video it said was shot outside that person’s home. Each of those posts is a separate authentication problem. Together they are a method. Steal or scrape a book of names. Sit on it. Announce a brand. Drip media that keeps the brand on television.

Israeli analysts at the International Institute for Counter-Terrorism called Bibi Gate a mask for Iranian psychological warfare and argued that intimidation and media time mattered more to Handala than a verified technical knockout. That reading is compatible with a real leak. A service that wants panic does not need to own every transistor in a chief of staff’s pocket. It needs enough true numbers to make the next official wonder which of his lines is already in Tehran. The PMO’s sentence about one mobile does not answer that fear. It answers a narrower question the government chose to answer.

Why a chief-of-staff address book is worth more than a trophy phone

Intelligence work is often just graph paper. Who calls whom. Who is one tap from the prime minister. Who is a foreign minister’s personal line rather than a switchboard. A dump that names those edges is useful long after the screenshots stop circulating. It is useful to an adversary building targeting lists. It is useful to criminals who want to spear-phish a ministry. It is useful to anyone who wants to know which journalist, donor, or foreign official sits in the same phone as a security chief.

That is why The AEGIS Alliance is not writing this as a gadget story. The gadget is the least interesting object in the file. The interesting object is the graph. Haaretz called that graph a gold mine. Official Israel called the handset uncompromised, or at least unproven. Readers can hold both lines. A newsroom that collapses them into “phone hacked” or “nothing happened” is doing the work of one of the two sides.

The political weather around the dump is Israel’s war in Gaza. Handala sells itself as a pro-Palestinian, Iran-tied witness named for Naji al-Ali’s cartoon boy. The branding rides a campaign that UN experts, legal scholars, and multiple states have called a genocide, and that this desk has documented as a system of bombardment, siege, and bureaucratic erasure. See the ban on 37 aid groups and the ceasefire-strike rebuke from Qatar, Egypt, and Jordan. A crew that claims to fight that campaign still has to prove its files. A government that runs that campaign still has to explain how its gatekeeper’s book left the building.

Authentication still belongs to forensics

Telegram captions are not affidavits. Neither are PMO sentences. The correct next step is the boring one: hash values, device logs, cloud tokens, and a public sample that a third party can match. Until that packet exists, every paragraph about Bibi Gate should carry the same qualifier. Claimed. Denied. Partially corroborated by a newspaper reconstruction of contact lists. Not closed.

That standard is the same one this desk uses on other hacker news files. It is also the standard official Israel would like to apply only to the adversary. A state that spends public money on offensive cyber cannot ask the press to treat every incoming dump as theater and every outgoing operation as necessity. The public interest is the graph, the denial, and the gap between them.

Braverman remained, in the weeks after the dump, the man who sat outside Netanyahu’s door and the man London was told to expect as an ambassador. Those two jobs make his contacts more valuable, not less. If the book is real, the value has already transferred. If the book is padded, the padding will show when a journalist dials a number and gets a dentist in Haifa. Either result is reportable. Pretending the dump never happened because a PMO source liked the word “indications” is not.

The AEGIS Alliance will keep the flight warning and the Braverman claim cross-linked, because that is how the operators staged them. A veiled threat against a Florida itinerary bought the first cycle. A contact book bought the second. The second is the one that will still be useful to someone with a spreadsheet long after the Mar-a-Lago photographs stopped running. See also the international news file. Until a lab owns the device story, the honest headline is the one this page is using: the dump hit the contacts, and the office that should know still will not say the phone itself fell.