Iran’s Mint Sandstorm APT Hits Universities with Hamas-Israel Phishing Scam

Microsoft warns that Iran-linked Mint Sandstorm (APT35) is running a sophisticated phishing campaign targeting high-profile researchers working on the Israel–Hamas conflict, leveraging compromised legitimate email accounts and benign-seeming lures to deliver a custom backdoor (MediaPl / MediaPI). The attack chain involves RAR archives unpacking double-extension .pdf.lnk files that execute curl to retrieve additional payloads from attacker-controlled subdomains; observed artifacts include .vbs persistence scripts, a renamed NirCmd binary, and malicious domains. Microsoft observed activity across the UK, USA, Belgium, France, Gaza, and Israel and recommends user training, SmartScreen-enabled browsers, network protection, and cloud-delivered defenses.