NewsBeef APT Revives BeEF for Global Watering Hole Campaigns

A known hacking group compromised a university website in Iran and many others globally to inject malicious code that can secretly monitor and track people’s web activity using their browsers.

The group responsible is called NewsBeef, also known as Charming Kitten or Newscaster. They are an advanced persistent threat (APT) group known for social engineering and using repurposed hacking tools.

Their main goal was to identify, track, and profile visitors to compromised websites, with occasional delivery of malware or phishing pages to selected high-value targets.

The attackers hacked websites using old vulnerabilities, then added hidden scripts that connected visitors’ browsers to a command server. These scripts could then track online behavior, gather data, or attempt further exploitation.

Targets included universities, embassies, government sites, military schools, and media organizations across multiple regions—particularly in the Middle East, Russia, Europe, and Asia.

The attackers were likely seeking sensitive information, credentials, or ways to infiltrate organizations by first learning who was visiting these websites and from where.

Yes, although many of the compromised sites have been cleaned, similar attacks continue to emerge, suggesting the group is actively updating its methods.

Keep websites and plugins up-to-date, monitor unusual traffic or scripts on your domain, and educate users about the dangers of suspicious sites or pop-ups asking for login details.