Charming Kitten's Expanding Cyber Campaign: Phishing for Political Influence

In mid-2019, Charming Kitten (APT35), an Iranian state-aligned hacking group, launched a broad credential-theft campaign targeting US presidential campaign staff, government officials, journalists, Iranian dissidents, and civil society groups including the Baha'i community. The group used four different phishing methods simultaneously — fake Google Drive links, SMS messages, spoofed account security alerts, and fake social media profiles — all designed to lure targets into entering their passwords on fake login pages for Google, Yahoo, Facebook, and Instagram. Microsoft identified 99 domains linked to the operation and obtained a court order to seize them. ClearSky documented the campaign in their "Kittens Are Back in Town 2" report published in October 2019.

The campaign was carried out by Charming Kitten, also known as APT35 or Phosphorus, an Iranian cyberespionage group active since at least 2014. The group is widely assessed to operate on behalf of Iranian state interests, with a focus on gathering political intelligence and monitoring dissidents, journalists, and civil society organizations critical of Iran. Microsoft tracks the group internally as Phosphorus and documented their attempts to target US election-related figures as part of Iran's broader cyber-enabled political interference activities.

The primary goal was credential theft — stealing login credentials for email and social media accounts to gain access to private communications, contacts, and documents. With access to a target's inbox or social media account, Charming Kitten can monitor their activities, identify their networks, and use their accounts to approach new targets. Targeting presidential campaign staff and government officials specifically aligns with Iran's interest in collecting political intelligence and potentially influencing US policy ahead of the 2020 election.

Microsoft reported 241 attempted attacks against US presidential campaign and government staff over a single 30-day period, with at least 4 successful account compromises. Beyond the US election sphere, ClearSky documented a much broader target set including journalists, academics, Iranian dissidents in France and the Middle East, and the Baha'i community. The scale of the infrastructure — 99 identified domains — indicates a sustained, large-scale operation rather than a narrow targeted campaign.

The campaign targeted US presidential campaign staff and former government officials (including people associated with the Trump administration), journalists covering Iran, Iranian dissidents and activists abroad, the Baha'i community, and human rights organizations. These groups collectively represent Charming Kitten's core intelligence priorities: monitoring opposition to the Iranian government, tracking US political decision-making on Iran, and surveilling communities the Iranian government considers threats to its stability.

Charming Kitten used four different methods to reach targets. First, spearphishing emails with links that appeared to be Google Drive document shares but led to fake login pages. Second, SMS messages sent directly to targets' phones with similar malicious links. Third, spoofed security alert emails mimicking Google or Microsoft notifications about suspicious login attempts, designed to panic targets into "verifying" their accounts on a fake portal. Fourth, fake social media profiles that made contact with targets and sent phishing links through social platforms. All four methods ultimately directed victims to convincing fake login pages for major services, capturing credentials in real time — including bypassing two-factor authentication prompts.

US election-related targets are attractive because access to campaign communications provides advance intelligence on US policy intentions toward Iran, including sanctions relief, nuclear negotiations, and regional security. Journalists covering Iran can be monitored to track what is known about Iranian operations and to identify potential sources. Dissidents and human rights activists are targeted to identify and expose opposition networks. The Baha'i community is of interest because it is considered a political threat by the Iranian government. Together, these communities give Iran a comprehensive intelligence picture of external threats to its political and security interests.