Iranian Cyber Espionage Strikes Again: Fake Modeling Agency Caught in the Act!
Unit 42 has uncovered a fake model agency website mimicking Germany’s Mega Model Agency. Visitors are met with obfuscated JavaScript that collects data like browser fingerprints and IP addresses. This cunning ruse likely serves Iranian cyber actors aiming to perform social engineering attacks. Beware of unsolicited glamorous opportunities!
Hot Take:
When life gives you lemons, make lemonade. When life gives you a fake model agency website, it’s probably a phishing scam. Keep your eyes peeled, and your JavaScript disabled, because it looks like Iran’s cyber tricksters are strutting down the runway with some new digital catwalk espionage!
Key Points:
- Iranian threat actors created a fake website mimicking a German model agency to collect visitor data.
- The website uses obfuscated JavaScript to capture information like IP addresses, browser fingerprints, and more.
- No direct victim interaction has been observed, but spear phishing is suspected as a method of luring victims.
- The operation is linked with high confidence to an Iranian threat group, potentially Agent Serpens (APT35/Charming Kitten).
- Palo Alto Networks offers products and services to help protect against these threats.
Already a member? Log in here