Iranian Threat Actors Steal Credentials Using Spear-Phishing

Iranian Spying on Expats, Syrians, Israelis

Iranian threat actors have been carrying out spear-phishing attacks against their perceived enemies abroad, stealing credentials from people of interest across the Middle East. The attacks, which have been ongoing despite mass protests in Iran, have targeted individuals involved in Iranian affairs, including Iranian, Syrian, Kurdish, Lebanese, Israeli, and American nationals.

Why This Matters

The Iranian government’s use of cyber spying tactics highlights the technical reality of state-sponsored cyber attacks, which often rely on social engineering and phishing techniques to compromise targets. The ideal model of cybersecurity would involve robust defenses against such attacks, but the failure scale and cost of these breaches can be significant, with over 850 credentials stolen in this campaign alone.

Key Insights

• 850 credentials stolen: Iranian threat actors used spear-phishing and social engineering to steal credentials from individuals across the Middle East, as reported by TechCrunch in 2026.
• Social engineering tactics: The attackers used a variety of tactics, including fake WhatsApp links, Telegram bots, and impersonation of public figures, to trick victims into revealing their credentials.
• Dynamic DNS provider exploitation: The attackers used a Dynamic DNS provider, DuckDNS, to hide constantly changing IP addresses behind simple phishing links.

Working Example

# Example of a phishing link using Dynamic DNS
import requests

# Define the phishing link
phishing_link = "http://alex-fabow.online"

# Define the DuckDNS API endpoint
duckdns_api = "https://www.duckdns.org/update"

# Use the requests library to send a request to the phishing link
response = requests.get(phishing_link)

# Print the response
print(response.text)

Practical Applications

• Use Case: The Iranian government’s use of cyber spying tactics highlights the importance of robust cybersecurity defenses, particularly against social engineering and phishing attacks.
• Pitfall: The use of Dynamic DNS providers to hide phishing links can make it difficult to track and block such attacks, emphasizing the need for advanced threat detection and mitigation strategies.

References:

• https://www.darkreading.com/cyberattacks-data-breaches/iran-spies-expats-syrians-israelis
• https://techcrunch.com/2026/02/05/iranian-threat-actors-spear-phishing-campaign/