A sophisticated phishing campaign named "The Return of The Charming Kitten" targeted high-profile individuals to steal their email login credentials and two-step verification codes. Attackers deceived their victims by sending fabricated security alerts and fake file-sharing links.

Who was behind the attack?

The attacks are attributed to "Charming Kitten," a hacking group supported by the Iranian government. The group is believed to have close ties to the Islamic Revolutionary Guard Corps (IRGC) and is known for orchestrating state-aligned cyber infiltration operations.

What are the nature and goals of the attack?

The core nature of the attack is espionage and intelligence gathering. By secretly infiltrating accounts, the attackers sought to monitor targets' real-time email communications to collect sensitive information surrounding international policies.

What is the scope or scale of the targeting?

The hackers rapidly built up a robust infrastructure, establishing more than 20 malicious domains in a short window between September and November 2018. They disseminated phishing links across a wide array of platforms, including direct emails and hacked accounts on Twitter, Telegram, and Facebook.

Were specific industries or people targeted?

The attackers specifically targeted non-Iranian political authorities, civil and human rights activists, journalists, and those involved in economic and military sanctions against Iran. The campaign focused heavily on American and Israeli citizens, with a clear objective to compromise their personal Yahoo! and Gmail accounts.

How was the attack carried out from a high-level perspective?

The attackers gathered intelligence to profile their targets and sent personalized messages containing fake Google Drive links or security warnings. When a victim entered their password on a convincing fake login page, the hackers verified it instantly and then prompted the user to hand over their two-factor authentication code.

Why might the targeted entities be attractive to attackers?

The targets influence or are actively involved in international policies, sanctions, and media narratives that directly affect the Iranian government. Infiltrating these accounts provides the attackers with valuable strategic insights into the activities and communications of those challenging Iran's interests.

What actions should organizations or individuals take to protect themselves?

Individuals should transition away from standard text message verification and use physical Security Keys, such as YubiKeys, for robust account protection. Furthermore, users should never click on links in suspicious alerts and should instead review account security by navigating directly to their email provider's settings.

Is this a widespread issue or a targeted one?

This campaign represents a highly targeted threat. The attackers carefully studied each victim prior to the attack, customizing their approach based on the individual's geographic location, cyber knowledge, contacts, and work schedule.

Threats Feed|Charming Kitten|Last Updated 29/10/2026|AuthorCertfa Radar|Publish Date13/12/2018

Charming Kitten Resurfaces: Targeting US Financial Sector and Global Activists

Actor Motivations: Espionage
Attack Vectors: Spear Phishing
Attack Complexity: Medium
Threat Risk: Low Impact/Low Probability

Threat Overview

In early October 2018, the Iranian-linked hacker group Charming Kitten initiated phishing attacks targeting U.S. financial institutions, possibly in response to new sanctions against Iran. These attacks expanded to include civil and human rights activists, political figures, and journalists in Iran and the West. The group used sophisticated phishing techniques, such as fake security alerts and deceptive Google Drive links, to gather sensitive information and credentials. They also employed real-time credential verification and 2-step verification code interception. Evidence suggests the attackers used VPNs and proxies, but real IP addresses traced back to Iran were also identified. The campaign's methods and targets are consistent with previous activities attributed to Charming Kitten.

Reference and Credit: Certfa - December 2018

The Return of The Charming Kitten

Detected Targets

Type	Description	Confidence
Sector	Human Rights	Verified
Sector	Journalists	Verified
Sector	Political	Verified
Region	Israel	Verified
Region	United States	Verified

Extracted IOCs

account-profile-users[.]info
accounts-support[.]services
broadcast-news[.]info
broadcastnews[.]pro
com-identifier-servicelog[.]info
com-identifier-servicelog[.]name
com-identifier-userservicelog[.]com
com-messengercenters[.]name
com-messengersaccount[.]name
confirmation-service[.]info
confirm-identification[.]name
confirm-identity[.]net
confirm-session-identification[.]info
confirm-session-identifier[.]info
confirm-verification-process[.]systems
continue-session-identifier[.]info
customer-recovery[.]info
customize-identity[.]info
documentofficupdate[.]info
documentsfilesharing[.]cloud
document-share[.]info
email-delivery[.]info
identifier-sessions-mailactivityid[.]site
invitation-to-messenger[.]space
login-users-account[.]site
mobilecontinue[.]network
mobile-messengerplus[.]network
my-scribdinc[.]online
notificationapp[.]info
podcastmedia[.]online
recoveryusercustomer[.]info
session-management[.]info
sessions-identifier-memberemailid[.]network
support-recoverycustomers[.]services
us2-mail-login-profile[.]site
users-account[.]site
accounts.confirm-verification-process[.]systems
activatecodeoption.ddns[.]net
aol.account-profile-users[.]info
books.com-identifier-servicelog[.]name
broadcastnews.ddns[.]net
broadcastpopuer.ddns[.]net
confirm.mobile-messengerplus[.]network
documents.accounts-support[.]services
documents.mobile-messengerplus[.]network
document.support-recoverycustomers[.]services
live.account-profile-users[.]info
mb.sessions-identifier-memberemailid[.]network
mobile.confirm-identification[.]name
mobile-sessionid.customize-identity[.]info
mobiles-sessionid.customize-identity[.]info
myyahoo.ddns[.]net
onlinemessenger.com-identifier-servicelog[.]name
securemail.mobile-messengerplus[.]network
services.confirm-identification[.]name
session-identifier-webservice.mobilecontinue[.]network
sessions.mobile-messengerplus[.]network
signin.account-profile-users[.]info
us2.login-users-account[.]site
noreply.customermails@gmail[.]com
notifications.mailservices@gmail[.]com
178[.]162.132.65
190[.]2.154.34
190[.]2.154.35
190[.]2.154.36
190[.]2.154.38
213[.]227.139.148
31[.]2.213.18
46[.]166.151.211
51[.]38.107.113
51[.]38.87.64
51[.]38.87.65
51[.]68.185.96
54[.]37.241.221
54[.]38.144.250
54[.]38.144.251
54[.]38.144.252
85[.]17.127.172
85[.]17.127.173
85[.]17.127.174
85[.]17.127.175
89[.]198.179.103
95[.]211.189.45
95[.]211.189.46
95[.]211.189.47

download

Tip: 85 related IOCs (24 IP, 59 domain, 0 URL, 2 email, 0 file hash) to this threat have been found.

Overlaps

Charming KittenCharming Kitten's Expanding Cyber Campaign: Phishing for Political Influence

Source: ClearSky - October 2019

Detection (four cases): documentsfilesharing[.]cloud, mobile-messengerplus[.]network, mobilecontinue[.]network, sessions-identifier-memberemailid[.]network

Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.

FAQs

The Return of The Charming Kitten Phishing Campaign

: A sophisticated phishing campaign named "The Return of The Charming Kitten" targeted high-profile individuals to steal their email login credentials and two-step verification codes. Attackers deceived their victims by sending fabricated security alerts and fake file-sharing links.
: The attacks are attributed to "Charming Kitten," a hacking group supported by the Iranian government. The group is believed to have close ties to the Islamic Revolutionary Guard Corps (IRGC) and is known for orchestrating state-aligned cyber infiltration operations.
: The core nature of the attack is espionage and intelligence gathering. By secretly infiltrating accounts, the attackers sought to monitor targets' real-time email communications to collect sensitive information surrounding international policies.
: The hackers rapidly built up a robust infrastructure, establishing more than 20 malicious domains in a short window between September and November 2018. They disseminated phishing links across a wide array of platforms, including direct emails and hacked accounts on Twitter, Telegram, and Facebook.
: The attackers specifically targeted non-Iranian political authorities, civil and human rights activists, journalists, and those involved in economic and military sanctions against Iran. The campaign focused heavily on American and Israeli citizens, with a clear objective to compromise their personal Yahoo! and Gmail accounts.
: The attackers gathered intelligence to profile their targets and sent personalized messages containing fake Google Drive links or security warnings. When a victim entered their password on a convincing fake login page, the hackers verified it instantly and then prompted the user to hand over their two-factor authentication code.
: The targets influence or are actively involved in international policies, sanctions, and media narratives that directly affect the Iranian government. Infiltrating these accounts provides the attackers with valuable strategic insights into the activities and communications of those challenging Iran's interests.
: Individuals should transition away from standard text message verification and use physical Security Keys, such as YubiKeys, for robust account protection. Furthermore, users should never click on links in suspicious alerts and should instead review account security by navigating directly to their email provider's settings.
: This campaign represents a highly targeted threat. The attackers carefully studied each victim prior to the attack, customizing their approach based on the individual's geographic location, cyber knowledge, contacts, and work schedule.

About Affiliation

Charming Kitten

Charming Kitten is an Iranian state-sponsored threat actor linked to the Islamic Revolutionary Guard Corps (IRGC) and active since at least 2012. The group conducts cyber espionage operations primarily targeting journalists, academics, political dissidents, think tank researchers, activists, and government officials across the Middle East, Europe, and the United States. Charming Kitten is best known for sustained credential phishing campaigns using fake login pages and social engineering, alongside the exploitation of known vulnerabilities in enterprise software. The cluster is tracked under numerous aliases across the industry including APT35, Magic Hound, Mint Sandstorm, and Phosphorus.

Associate threats