US agencies and cybersecurity researchers are sounding the alarm over a rise in Iranian state-sponsored spear-phishing attacks. These attacks focus on high-profile individuals, employing advanced tactics to steal Google account credentials while circumventing two-factor authentication measures.
US cybersecurity agencies, including CISA, FBI, and international partners, have issued a warning about an escalation in spear phishing attacks orchestrated by Iranian state-sponsored actors. These campaigns target high-value individuals, journalists, cybersecurity professionals, and computer science professors, primarily in Israel. The attackers are leveraging AI-enhanced social engineering, including fake Gmail login pages and Google Meet invitations, to steal credentials and bypass two-factor authentication (2FA).
The threat actors behind these operations are associated with the IRGC-linked APT group often referred to as “Educated Manticore,” “Charming Kitten,” or APT35/APT42. Strategies include:
The most active hacktivist groups include:
Most targeted sectors:
According to the security agencies, “Over the past several months, there has been increasing activity from hacktivists and Iranian government-affiliated actors, which is expected to escalate due to recent events. These cyber actors often exploit targets of opportunity based on the use of unpatched or outdated software with known Common Vulnerabilities and Exposures or the use of default or common passwords on internet-connected accounts and devices.”
Recent reports from Censys and SOCRadar shed light on the scale of internet-exposed industrial devices and the surge in cyberattacks linked to the 2025 Iran-Israel conflict:
Device exposure by vendor (via Censys):
Cyberattack activity (via SOCRadar):
If you’re among the targeted demographic, exercise extreme caution around unsolicited meeting invitations or emails asking for credentials, even if they seem to come from trusted sources. Safeguard your accounts by using hardware-based multi-factor authentication, verifying domain names before logging in, and applying phishing-resistant email protections.
See also: HIPAA Compliant Email: The Definitive Guide (2025 Update)
Spear-phishing is a targeted cyberattack where attackers impersonate a trusted source, such as a colleague or known organization, to trick individuals into revealing sensitive information like passwords or clicking malicious links.
Victims receive seemingly legitimate emails or WhatsApp messages, often mimicking Google services like Gmail or Meet. These messages direct users to fake login pages designed to steal credentials and bypass two-factor authentication (2FA).
The attackers use AI to generate flawless, convincing messages and advanced phishing kits that mimic real login pages. These kits can capture login details and 2FA codes in real time, making them highly effective.