Iran hunts down double agents with fake recruiting sites, Mandiant reckons

Mandiant reported a government-backed Iranian operation (active from at least 2017 through March 2024) that used over 35 fake Israeli-themed recruiting websites and social accounts to lure Farsi speakers into submitting names, birth dates, contact details, addresses, and professional histories; the harvested data could be used for identification, targeting, or physical harm, and the activity is attributed with high confidence to Iranian actors with a weak overlap to APT42.