APT42 Uses AI-Assisted Phishing and TAMECAT Malware to Target Officials

Iran-linked cyber espionage group APT42 is combining patient social engineering, AI-assisted research, credential phishing, and an expanded TAMECAT backdoor to target government and defense officials. The group also approaches policy experts and relatives of high-value targets.

Instead of sending large volumes of phishing emails, APT42 builds relationships over days or weeks. Operators impersonate conference organizers, researchers, journalists, diplomats, and other credible contacts before delivering a malicious document or login page.

A July 2026 DarkAtlas analysis of APT42 says the group uses generative AI for target research, persona development, translation, lure creation, debugging, and malware engineering. AI helps the operators produce polished communications, but the campaign still depends on human interaction and a victim taking the requested action.

What Is APT42?

APT42 is an Iranian state-sponsored espionage group that has operated since at least 2015. Security researchers also track related or overlapping activity under names that include Charming Kitten, CharmingCypress, Mint Sandstorm, Educated Manticore, TA453, and Yellow Garuda.

Google Mandiant’s APT42 research assesses that the group operates on behalf of Iran’s Islamic Revolutionary Guard Corps Intelligence Organization. Its operations focus on intelligence collection and surveillance rather than direct financial gain.

The group has targeted officials, military personnel, political campaigns, diplomats, academics, journalists, researchers, legal organizations, human rights groups, and other people with access to information that may interest the Iranian government.

SpearSpecter Targets Senior Officials and Their Families

Israel’s National Digital Agency named the campaign SpearSpecter when it disclosed the operation in November 2025. The official SpearSpecter investigation linked the activity to Iranian operators aligned with the IRGC intelligence organization.

Researchers found that the operators systematically approached senior government and defense officials. They also targeted family members in some cases, widening the number of people who could provide access or sensitive personal information.

The attackers used invitations to prestigious conferences, interview requests, strategic meetings, and professional documents as conversation starters. They moved discussions between personal email, corporate accounts, and WhatsApp to make the relationship feel authentic.

Campaign element	Observed activity	Security risk
Target research	Collection of professional, political, and personal information	Highly personalized phishing approaches
False personas	Impersonation of researchers, organizers, journalists, and officials	Victims may trust familiar roles or institutions
Extended conversations	Engagement through email and WhatsApp over several days or weeks	Trust forms before the attacker introduces a link
Credential phishing	Fake cloud document and meeting pages	Theft of passwords, MFA codes, and sessions
Malware delivery	PDF-themed shortcuts and modular PowerShell payloads	Persistent access to Windows systems

How AI Supports APT42 Phishing

DarkAtlas assesses that APT42 uses generative AI across several parts of its operation. These uses reportedly include researching targets, designing believable identities, translating messages, improving phishing pretexts, generating code, and troubleshooting malware.

AI can help an operator create messages that match a target’s profession, interests, language, and communication style. It can also reduce spelling and grammar errors that once helped users identify suspicious emails.

The available reporting does not show an autonomous AI system selecting and compromising victims without human control. APT42 operators still manage the conversations, choose delivery methods, and decide when to introduce credential-harvesting pages or malware.

How the TAMECAT Infection Chain Works

One documented SpearSpecter route starts with a link presented as a meeting, conference, or briefing document. The victim reaches a lure page that invokes the Windows search-ms protocol and asks for permission to open File Explorer.

If the user approves the request, File Explorer connects to an attacker-controlled WebDAV location. The remote folder displays a Windows shortcut that uses a PDF-style name and icon, encouraging the victim to treat it as a normal document.

Opening the LNK file launches Command Prompt and downloads a batch file. The batch stage then uses PowerShell to retrieve and execute additional TAMECAT components, often in memory.

1. The attacker sends a personalized document link.
2. The web page invokes the Windows search-ms handler.
3. File Explorer connects to a remote WebDAV share.
4. A malicious LNK file appears as a PDF document.
5. The shortcut launches cmd.exe and downloads a batch file.
6. PowerShell retrieves TAMECAT modules from remote infrastructure.
7. The malware establishes persistence and begins receiving commands.

TAMECAT Provides Modular Espionage Capabilities

TAMECAT is a PowerShell-based backdoor with modules for system discovery, surveillance, data collection, remote command execution, and file theft. Operators can select modules according to their intelligence requirements.

The expanded malware described in the DarkAtlas TAMECAT report can collect browser data, search files, capture screenshots, inspect processes, access Outlook data, run commands, and package information for exfiltration.

TAMECAT can communicate through HTTPS, Discord, and Telegram. Multiple channels give operators alternatives when defenders block one service or remove part of the infrastructure.

• Collect browser cookies and stored credentials
• Capture repeated screenshots
• Search for documents and other files
• Gather system, network, process, and security-product information
• Access Outlook mailbox data
• Execute PowerShell and other commands
• Upload and download files
• Compress collected data for exfiltration
• Send data through HTTPS, Discord, or Telegram

Credential Phishing Remains a Major APT42 Tactic

APT42 does not always deploy malware. The group also sends targets to login pages that imitate Google, Microsoft, OneDrive, and other trusted services.

In some operations, the first link leads to a legitimate or harmless document. The attacker introduces a credential-harvesting page only after additional conversation. This sequence makes the earlier safe content part of the social-engineering process.

Google’s Threat Analysis Group has documented APT42 using cloud services, shortened links, fake document pages, malicious redirects, and impersonated login forms against officials, defense-linked individuals, diplomats, political groups, academics, and civil society organizations.

Why Stolen Cookies Create Lasting Account Risk

TAMECAT’s browser-data collection can expose more than saved passwords. Authentication cookies and session tokens may allow an attacker to reuse an existing login session without entering the password again.

A password reset may not terminate every stolen session. After a suspected infection, security teams should revoke active sessions, invalidate refresh tokens, review registered authentication methods, and examine recent account activity.

Responders should also investigate mailbox rules, forwarding settings, recovery methods, OAuth permissions, newly registered devices, and unusual sign-ins. APT42 has previously used stolen credentials to access cloud environments and collect sensitive documents, according to Mandiant’s investigation of APT42 operations.

Detection Should Focus on the Full Attack Chain

Individual events in this campaign may look harmless. Browsers commonly open protocol handlers, Windows uses WebDAV for legitimate file access, and administrators frequently use PowerShell.

The combined sequence provides a stronger detection signal. Security teams should correlate a browser invoking search-ms, rundll32.exe calling davclnt.dll, File Explorer accessing a remote WebDAV share, an LNK file launching cmd.exe, and PowerShell or curl.exe retrieving external content.

Detection stage	Activity to monitor
Initial link	Browser redirects followed by a search-ms request
WebDAV access	rundll32.exe loading davclnt.dll and contacting an external host
Shortcut execution	A remote LNK file spawning cmd.exe
Payload retrieval	curl.exe or PowerShell downloading scripts
In-memory execution	Encoded or obfuscated PowerShell and Invoke-Expression activity
Command and control	Unexpected connections to Telegram, Discord, Netlify, or cloud-hosting services
Account abuse	New inbox rules, OAuth grants, devices, recovery methods, or session reuse

How Organizations Can Defend High-Risk Users

Senior officials and their staff should verify unexpected invitations, interviews, and document requests through a separate communication channel. A known organization name, accurate personal details, or a long conversation does not confirm the sender’s identity.

The SpearSpecter security recommendations call for stronger endpoint visibility, PowerShell script-block logging, Sysmon telemetry, endpoint detection, application controls, and restrictions on the search-ms protocol where business requirements allow.

• Use phishing-resistant MFA such as FIDO2 security keys or passkeys.
• Protect personal accounts used by officials and their families.
• Verify new contacts through published organizational details.
• Block unapproved LNK, batch, and PowerShell execution.
• Enable PowerShell logging and centralize the logs in a SIEM.
• Restrict WebDAV access to approved locations.
• Review the need for the Windows search-ms protocol.
• Monitor Discord and Telegram traffic from systems that do not require those services.
• Revoke sessions and rotate credentials after suspected compromise.
• Preserve email, WhatsApp, identity, browser, and endpoint evidence for investigation.

High-risk Google users can also consider the Advanced Protection Program. Google recommends the program for elected officials, campaign workers, journalists, government personnel, and others who may face government-backed phishing.

Selected Indicators of Compromise

The following indicators come from the newer TAMECAT delivery activity. Teams should use them with behavioral evidence because attackers can replace free hosting, cloud pages, and staging domains quickly.

Type	Indicator	Description
File name	Document.pdf.lnk	PDF-themed Windows shortcut
SHA-256	783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104	Reported hash for the malicious shortcut
Domain	cloudfilenow[.]online	LNK staging infrastructure
Domain	synctimenow[.]org	LNK staging infrastructure
Domain	personal-store[.]netlify[.]app	Reported LNK delivery endpoint
Domain	projects-shared[.]netlify[.]app	TAMECAT controller and module-delivery host
File name	8.cmd	Batch file used during the delivery chain
SHA-256	5c38af2f39802c0362a72247bfd52a35e16b93f45dfe1a2b573a2e620c8d1189	Reported batch-stage hash
Registry value	systemUpdating	RunOnce persistence associated with a workbook delivery path
Domain	hsta[.]xyz	Workbook staging host
Domain	transfergocompany[.]com	APT42 redirector infrastructure
Hostname	fileportalshare[.]netlify[.]app	OneDrive-themed credential-harvesting page

Organizations should avoid treating a domain or hash match as conclusive attribution. Confirm the surrounding behavior, timing, user interaction, process chain, and account activity before making an incident determination.

FAQ