New Charming Kitten Operation Blends Long-Term Reconnaissance and WebSocket Phishing

A well-known Iranian espionage group launched a new phishing operation using a fake Telegram account impersonating a U.S. government official. The goal was to lure Iranian activists and researchers into a realistic Google login page and steal their account credentials.

The activity aligns with Charming Kitten, an Iranian state-linked cyber unit known for targeting activists, journalists, and academics. Their tactics and infrastructure closely match previous operations from this group.

The primary targets were Iranian activists, researchers, and individuals involved in political or security issues related to Iran. The attackers specifically monitored a public Telegram channel linked to researcher activity.

The attackers used a real U.S. official’s identity, previously involved in controversy, to make the impersonation more believable. They also monitored researchers for months and deployed more than 30 new phishing domains in a short time.

Victims were contacted through Telegram and directed to a Google Sites page, then to a phishing website. The page imitated Google’s login process and used real-time WebSocket technology to capture credentials instantly.

Iranian activists and researchers often hold information that is politically sensitive for the Iranian government. Impersonating a U.S. official made the lure more compelling and credible within these circles.

The campaign was highly targeted, focusing on specific individuals rather than broad populations. However, the scale of the infrastructure suggests the group is planning or conducting multiple related operations.