I Spy With My Little Eye: Uncovering an Iranian Counterintelligence Operation

Mandiant describes a suspected Iran-nexus counterintelligence campaign (2017–2024) that used a coordinated network of fake Israel-branded recruitment websites and social media personas to socially engineer Farsi-speaking targets into submitting personal and professional data; the activity is attributed with high confidence to Iran’s regime with noted overlap to APT42 and is intended to identify collaborators and domestic threats.