It’s one of the oldest Facebook scams in the book: an “attractive woman” flirts with lonely men via friend request, sends them pictures, engages in conversation, and then pulls a con. These kind of tricks seem easy to detect, but they can be surprisingly effective — just ask a bunch of Israeli soldiers who recently got duped by Hamas operatives on Facebook.

Most Facebook scams seek to rip off users, but this one could’ve been a matter of life and death. Hamas agents stole photos from innocent peoples’ Facebook profiles to create fake ones, hooked the attention of Israeli soldiers, and then sent the men a link to download a special video chat app to continue talking off Facebook. However, when the Israeli soldiers clicked the link, malware downloaded onto the soldiers’ devices and turned them into spying tools. The malware allowed Hamas to see the soldiers’ location, apps, pictures, files and contacts — and it could even stream video and audio from infected phones.

The scam was quickly identified and eliminated, but not before Hamas successfully hacked several phones. While spy work like this can seem far removed from our daily lives, it provides a good lesson for our own privacy practices online.