APT42 Hackers Pose as Journalists to Harvest Credentials and Access Cloud Data

Mandiant reports that Iranian state-backed APT42 conducts sophisticated social-engineering campaigns—posing as journalists and event organizers—to harvest credentials, bypass MFA, and access cloud environments of Western and Middle Eastern NGOs, media, academia, legal services, and activists; the actor uses minimal-footprint techniques, open-source tools, OneDrive exfiltration, anonymized infrastructure, and custom backdoors (NICECURL/BASICSTAR and TAMECAT) to covertly collect strategic intelligence for Iran.