On Tuesday, a phishing campaign targeting individuals involved in Iran-related activities was highlighted by U.K.-based Iranian activist Nariman Gharib. Gharib shared redacted screenshots of a suspicious link received through WhatsApp, advising others to avoid clicking on such links. This incident follows a period of intense anti-government protests in Iran, coinciding with the nation experiencing its most extended internet shutdown.
In collaboration with TechCrunch, Gharib provided the full phishing link, which allowed for an analysis of the malicious web page's source code. The investigation revealed that the attackers aimed to steal credentials from platforms like Gmail and WhatsApp, as well as to conduct surveillance by accessing sensitive data such as location information and personal media.
Among the victims identified were a Middle Eastern academic, the head of an Israeli drone manufacturer, and a senior cabinet minister from Lebanon, as well as individuals with U.S. phone numbers. The phishing site, previously operational through a subdomain on DuckDNS, has since been taken down. A security vulnerability left victims' responses accessible on the attacker's server, revealing a troubling number of compromised accounts.