Iranian Spear-Phishing Attack Mimic Google, Outlook, and Yahoo Domains

A sophisticated Iranian cyber espionage campaign has resurfaced with renewed intensity, targeting high-profile figures through meticulously crafted spear-phishing operations that impersonate major email providers including Google, Outlook, and Yahoo.

The campaign, attributed to the threat actor known as Educated Manticore, represents a significant escalation in Iranian cyber warfare capabilities amid heightened geopolitical tensions in the Middle East.

The Iranian group, also tracked under the aliases APT42, Charming Kitten, and Mint Sandstorm, operates under the auspices of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization.

Their latest operations demonstrate a marked sophistication in social engineering techniques, employing fictitious personas tied to legitimate institutions, precise timing coordination, and multi-channel communication strategies to compromise credentials and circumvent multi-factor authentication systems.

Recent intelligence indicates the campaign has expanded its targeting scope to include leading Israeli computer science academics, cybersecurity researchers, and prominent journalists covering geopolitical developments.

Check Point analysts identified over 100 malicious domains specifically engineered to mimic legitimate services, with particular focus on replicating Google, Outlook, and Yahoo authentication interfaces.

The threat actors have also created convincing replicas of meeting platforms such as Google Meet to facilitate their credential harvesting operations.

The campaign’s operational methodology reveals considerable tactical evolution. Initial contact vectors vary strategically based on target profiles, utilizing both traditional email communications and encrypted messaging applications like WhatsApp.

Once contact is established, victims are directed toward sophisticated phishing infrastructure that employs advanced web development frameworks to create pixel-perfect replicas of legitimate login interfaces.

Advanced Social Engineering and Multi-Factor Authentication Bypass

The most concerning aspect of this campaign lies in Educated Manticore’s demonstrated ability to circumvent modern security controls, particularly multi-factor authentication systems.

The threat actors employ sophisticated social engineering techniques that trick victims into voluntarily sharing their authentication codes during the phishing process, effectively neutralizing what should be a robust security control.

The visual fidelity of these fake authentication pages redirect users to attacker-controlled infrastructure while maintaining the appearance of legitimate service interactions.

The group’s impersonation capabilities extend beyond technical infrastructure to include highly convincing persona development, with attackers successfully masquerading as mid-level employees at major Israeli firms, government officials from the Prime Minister’s Office, and professionals from established technology companies.

These communications exhibit grammatical precision and formal structure, suggesting potential AI assistance in content generation, though subtle inconsistencies such as minor name misspellings occasionally reveal their fraudulent nature.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now