APT42 Targets Officials with AI Phishing, TAMECAT Malware

Key Takeaways

• Iran-linked APT42 is employing AI to enhance its phishing campaigns, making social engineering attacks more sophisticated and difficult to detect.
• The group is targeting high-value individuals, including government and defense officials and their family members, with tailored, long-term phishing efforts.
• APT42’s updated TAMECAT malware now boasts increased resilience and advanced capabilities for data exfiltration and persistent access.
• Detection requires a holistic view of user activity, combining email history, endpoint telemetry, and identity logs, rather than relying on isolated indicators.

The Iranian state-sponsored cyber espionage collective known as APT42 has significantly upgraded its phishing operations, leveraging artificial intelligence for more convincing social engineering and deploying a more robust version of its proprietary TAMECAT malware. This enhanced capability allows the group to execute highly targeted and persistent attacks.

Recent campaigns have focused on senior government and defense personnel, policy experts, and even their family members, indicating a strategic targeting of individuals with access to sensitive information. Unlike conventional broad-stroke phishing, APT42 meticulously cultivates trust with its targets through prolonged interactions across various communication channels, including personal and corporate email, as well as WhatsApp.

This patient, relationship-based approach makes the group’s malicious activities exceptionally challenging to identify. The subtle nature of these interactions bypasses typical red flags like poor grammar or generic content, which are often indicative of less sophisticated phishing attempts.

Analysts at DarkAtlas said in a report that APT42’s latest tactics combine sophisticated relationship-based phishing with credential theft and advanced malware delivery. The report, shared with Cyber Security News (CSN), highlights the group’s use of generative AI to conduct in-depth target research, craft highly believable fake identities, translate communications flawlessly, develop malicious code, and refine their social engineering lures. This integration of AI results in campaigns capable of both stealing credentials and establishing long-term unauthorized access to victim devices. The enhanced resilience of the new TAMECAT malware ensures that operations remain active by diversifying delivery methods, hosting providers, and command channels.

APT42’s AI-Assisted Phishing and TAMECAT Malware

The current campaign, dubbed SpearSpecter, employs professional themes such as invitations to conferences, interview requests, and shared meeting documents to engage targets. Operators are observed to spend days or even weeks building a facade of legitimacy before delivering a malicious link. This patient methodology renders traditional indicators of AI spear phishing, such as grammatical errors or generic phrasing, largely ineffective for early detection.

In one observed attack chain, victims were directed to a webpage that exploited the Windows search-ms handler, prompting them to open File Explorer. Upon user approval, Explorer connected to a WebDAV share controlled by the attackers. Here, a malicious shortcut file, disguised as a PDF document (Document.pdf.lnk with SHA-256 hash 783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104), awaited execution. This LNK file was staged at locations such as cloudfilenow[.]online:8050/filebgeu/document.pdf.lnk, 107.189.25.188:8050/filebgeu/document.pdf.lnk, and synctimenow[.]org:8050/filebgeu/document.pdf.lnk, with personal-store.netlify.app/yo3u serving as a confirmed delivery endpoint.

Executing the shortcut launched Command Prompt, which subsequently downloaded a batch file (8.cmd, SHA-256 hash 5c38af2f39802c0362a72247bfd52a35e16b93f45dfe1a2b573a2e620c8d1189) and utilized PowerShell to retrieve additional components. This method mirrors broader abuse of Windows WebDAV for delivering remote files, making them appear as innocuous local documents to unsuspecting users. The batch file communicated with the command and control server using a tracking value of bgeuYESS and a session key fragment bgeu, sending requests with the HTTP parameter RNE2randomINE2 and receiving base64 tasking in the HTTP field N.

TAMECAT is a sophisticated malware capable of extensive data exfiltration and control. Its functionalities include collecting browser cookies and credentials, searching for specific files, capturing screenshots, accessing Microsoft Outlook mailbox data, executing arbitrary commands, and packaging stolen information. This data is then exfiltrated via multiple channels, including HTTPS, Discord, and Telegram. The domain projects-shared.netlify.app was identified as a TAMECAT controller and PowerShell module-delivery host, with projects-shared.netlify.app/Top4d as a DGA-stage delivery endpoint and projects-shared.netlify.app/home for module result uploads. The use of temporary file TEMP.txt by the PersistenceMonitor module and the registry value systemUpdating for RunOnce persistence via a macro-enabled workbook (staged on hsta.xyz) further demonstrate its advanced capabilities.

The ability to steal browser cookies poses a significant identity risk, as a simple password reset may not be sufficient to revoke an attacker’s persistent access. Organizations must prioritize revoking active sessions, refreshing tokens, thoroughly reviewing browser-stored credentials, and investigating any suspicious sign-in attempts after a potential compromise. The PowerWindows controller endpoint was identified as 1thebstack1[.]xyz/ApiSession.

Detection Requires Context

APT42’s phishing tactics also include credential-harvesting pages designed to mimic legitimate cloud document services. In a March 2026 operation, the group initially used a benign OneDrive-hosted PDF (SHA-256 hash 16db04b632668dae081359fc07c97e5a9b79dad61713642e48b494aa6b7828be) to build trust. Subsequent communication then redirected targets to an attacker-controlled login page, a technique reminiscent of recent OneDrive credential phishing attacks. The hostname fileportalshare.netlify.app was identified as a OneDrive-themed credential-harvesting page, and transfergocompany.com as a TA453-controlled redirector. An attacker-controlled email account, [email protected], was used to impersonate a researcher.

Security teams must analyze the entire communication history, rather than assuming a legitimate initial link guarantees sender safety. Any abrupt shift in communication channels—such as moving from personal email to corporate email or WhatsApp, a change in document destination, or an unexpected request to re-authenticate—should trigger immediate verification through an independent channel.

Endpoint monitoring should prioritize correlated events, such as a browser initiating search-ms, rundll32.exe leveraging davclnt.dll for WebDAV access, a remote LNK file executing cmd.exe, and curl or PowerShell retrieving additional content. This sequence of interconnected events provides a far more robust warning of malicious activity than isolated indicators like a specific domain, file hash, or single process event.

The sophistication of this campaign underscores the evolving threat landscape, where patient social engineering combined with adaptive malware can effectively compromise high-value targets. Defenders must integrate email history, endpoint telemetry, identity logs, and threat intelligence to accurately discern whether an attempted interaction has progressed into a full compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Implement phishing-resistant Multi-Factor Authentication (MFA), such as FIDO2 security keys or passkeys, especially for high-risk users.
• Disable legacy authentication protocols wherever feasible across your organization.
• Actively monitor for unusual inbox rules, changes in email forwarding settings, new OAuth permissions, modifications to account recovery methods, and any instances of session token reuse following suspicious communications.
• Educate users, particularly those in sensitive roles, on the evolving tactics of sophisticated social engineering, emphasizing the importance of verifying unexpected requests through independent channels.
• Enhance endpoint detection and response (EDR) capabilities to monitor for correlated event sequences rather than isolated indicators. Specifically, look for browser interactions with search-ms, rundll32.exe using davclnt.dll, remote LNK file execution of cmd.exe, and subsequent content retrieval via curl or PowerShell.
• Regularly review and revoke active user sessions and refresh tokens, and meticulously audit browser-stored credentials and suspicious sign-ins after any suspected compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.