An Iran-linked espionage group is using generative AI to sharpen its phishing and a modular backdoor to hold long-term access to the devices of government and defense officials.

 

What happened

Researchers have documented fresh activity from APT42, an Iran-linked cyber espionage group, pairing AI-assisted target research with a hardier version of its TAMECAT backdoor, a piece of malware that gives an attacker remote control of an infected computer, according to CyberSecurityNews. The targets are senior government and defense officials, policy experts, and in some cases the family members of high-value individuals. Rather than blasting out large volumes of obvious spam, the group builds trust over time through realistic conference invitations, drawn-out conversations, and messages delivered across personal email, corporate accounts, and WhatsApp. These threat actors are uniquely patient. When a victim is eventually asked to click a link or open a document, the relationship already feels legitimate, which strips away the warning signs staff are trained to watch for.

 

Going deeper

The malware delivery relies on a Windows feature most people never think about. Victims are steered to a page that triggers the search-ms handler, the mechanism Windows uses to open saved searches in File Explorer, and are prompted to open File Explorer. Approving that prompt connects the machine to an attacker-controlled WebDAV share, a remote folder that behaves like a local drive, where a shortcut file dressed up to look like a PDF sits waiting. Running it launches Command Prompt, pulls down a batch file, and uses PowerShell to fetch the remaining pieces. What arrives is TAMECAT, and the research shows it does far more than download other tools. The backdoor harvests browser cookies and saved passwords, hunts through files, captures screenshots, reads Outlook mailbox data, runs commands, and ships stolen material via several channels, including standard web traffic, Discord, and Telegram. The stolen browser cookies matter most for defenders, because a session cookie proves a user is already logged in, so an attacker holding one can slip back into an account even after the victim changes the password. Cleaning up means revoking active sessions and refresh tokens, checking browser-stored credentials, and reviewing suspicious sign-ins, not just resetting passwords.

 

What was said

"The campaign has systematically targeted high-value senior defense and government officials using personalized social engineering tactics," said Israel National Digital Agency researchers Shimi Cohen, Adi Pick, Idan Beit-Yosef, Hila David, and Yaniv Goldman, as reported by The Hacker News when the agency published its findings in November 2025. "These include inviting targets to prestigious conferences or arranging significant meetings."

 

In the know

The operation carries the codename SpearSpecter, and the Israel National Digital Agency's original research attributes it with high confidence to operators working on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization, the intelligence arm of Iran's most powerful military body. An early benign document often does the quiet work of establishing trust before anything malicious appears. In a March 2026 operation, the group first sent a harmless PDF hosted on OneDrive, then followed up with a separate link that routed the target to a fake login page built to capture credentials. The lesson for defenders is that a clean first link proves nothing about the messages that follow. A sudden jump from personal email to a corporate address or WhatsApp, a changed document destination, or an out-of-nowhere request to sign in again all warrant verification through a separate, trusted channel before anyone acts. On the technical side, single alerts rarely tell the story. A browser opening search-ms, a remote shortcut file spawning Command Prompt, and PowerShell reaching out to fetch content mean little in isolation, yet strung together in sequence they form a much stronger signal that something is wrong.

 

The big picture

The AI angle is what separates this campaign from the spear-phishing officials have faced for years. Google's threat intelligence group reported in February 2026 that APT42 misused its Gemini models to hunt down official email addresses for specific organizations, research potential business partners to build a believable pretext, and when given a target's biography, craft a persona or scenario likely to draw engagement, before Google disabled the accounts tied to the activity. Well-written, culturally fluent lures no longer betray themselves through clumsy grammar, which erodes one of the oldest pieces of phishing advice. The defensive answer leans on controls that do not depend on a user spotting the fake. High-risk staff should move to phishing-resistant multi-factor authentication such as FIDO2 security keys or passkeys, which tie a login to the genuine website's address so the sign-in simply fails on a lookalike page, and organizations should retire legacy authentication methods where they can. Email remains the entry point, and according to Paubox's report on the top three healthcare email attacks, credential phishing that leads to mailbox takeover caused more patient data exposure than any other email attack pattern in 2025, a reminder that stopping the message before anyone clicks stays the most reliable defense across every sector.

 

FAQs

Why does malware run through PowerShell and Command Prompt instead of a standalone program?

Living off built-in Windows tools lets attackers avoid dropping recognizable malicious files that antivirus software would flag. Because PowerShell and Command Prompt are legitimate administrative tools present on every system, their activity blends into normal operations, which is why monitoring how they are used matters more than blocking them outright.

 

What makes a "fileless" backdoor harder to catch than traditional malware?

A fileless implant runs largely in memory rather than writing itself to disk, so scans that look for malicious files on the hard drive often find nothing. Detection shifts toward behavioral signals, such as unusual process chains and unexpected outbound connections, rather than matching a known file signature.

 

Why would attackers route stolen data through Discord and Telegram?

Traffic to mainstream messaging platforms looks ordinary and usually is not blocked, letting stolen data leave the network without tripping alarms that watch for connections to unfamiliar servers. Using trusted services as a command channel also spares the attacker from maintaining infrastructure that defenders could identify and take down.

 

How does targeting family members help an espionage operation?

Relatives typically run weaker security than the official does and can be used as a softer route to reach the primary target or apply pressure. Compromising a family member's device or account can also yield personal context that makes later approaches against the official more convincing.

 

What is threat intelligence sharing and why does it matter here?

Threat intelligence sharing is the practice of organizations exchanging technical indicators, such as malicious domains and file fingerprints, so that one group's discovery becomes another's early warning. Campaigns like this one surface publicly because research teams publish their findings, which lets defenders elsewhere search their own logs for the same activity before it escalates.