U.S. intelligence reportedly intercepted an encrypted signal that analysts believe may be an operational trigger intended for covert Iranian sleeper assets abroad, according to an alert reported by ABC News.
The message was described as targeted at “sleeper assets” — operatives living quietly among civilians until they receive orders to act.
Officials say the coded transmission surfaced soon after Ayatollah Ali Khamenei was killed in a joint U.S.-Israeli airstrike in Tehran on Feb. 28 and after his son, Mojtaba Khamenei, was elevated to supreme leader.
American analysts reported the encryption travelled across multiple countries and was flagged by U.S. agencies as “likely of Iranian origin,” using passcodes to reach clandestine recipients.
Observers noted the signal showed “international rebroadcast characteristics,” suggesting it was meant to reach operatives already positioned outside Iran; no specific target or location has been identified.
These transmissions match methods historically used to deliver instructions to covert operatives without relying on the internet.
Domestic threat and border vulnerabilities
Officials worry the signal could be intended to activate prepositioned sleeper assets operating outside the originating country, including the possibility some may already be inside the United States.
The concern has sharpened as the conflict enters its second week, with national security and border integrity rising as top priorities for officials.
The Daily Mail previously reported on a passport pipeline involving Iranian-linked operatives traveling through Venezuela before entering Western countries — a potential route that could allow networks to gain a foothold near the U.S.
Warnings from security experts
Security analysts warn the danger could come from lone actors sympathetic to Tehran or from organized sleeper networks waiting for activation orders.
In an interview with the Daily Mail, former Department of Homeland Security adviser and Secret Service supervisor Charles Marino said the United States could face a “convergence” of threats from multiple vectors.
Marino warned it is possible small cells of 10 to 20 people could carry out simultaneous or near-simultaneous attacks, focusing on “soft” targets to maximize casualties.
The coming World Cup has been designated a National Special Security Event and draws concern because it will concentrate massive international crowds at vulnerable venues.
Meanwhile, tensions have risen after Israeli forces struck Iranian oil depots — a move that reportedly strained ties between Washington and Jerusalem and alarmed White House officials about potential impacts on gasoline prices for Americans.
The alert and expert warnings underscore the need for vigilant security measures both at home and abroad as officials monitor for any signs of activation.
