APT42 Targeting Middle East

APT42 is an Iranian threat group launching social engineering and credential phishing campaign against human rights activists, journalists, researchers, academics, diplomats, and politicians working in the Middle East. The threat actor distributed fake shortener URLs through WhatsApp to redirect the victim to fake login pages appearing as Microsoft, Google, or Yahoo legitimate login page; therefore, the threat actor will gain access to the victim’s email accounts and get all the sensitive data and credentials such as emails, cloud storage drives, calendars, and contacts. By leveraging the Google Takeout service, all the data related to web searches, payments, travel and locations, and YouTube activities can be exported. Unfortunately, victims don’t receive any security warnings or notifications from Google and remain unaware of Gmail account compromise and a Google Takeout initiation.