HOW A HACKING CAMPAIGN TARGETED HIGH-PROFILE GMAIL AND WHATSAPP USERS ACROSS THE MIDDLE EAST

Summary from the TLDR InfoSec newsletter

A phishing campaign delivered via WhatsApp targeted Iranian activists, academics, government officials, and business leaders across the Middle East, stealing Gmail credentials with 2FA codes, hijacking WhatsApp accounts via malicious QR codes, and attempting to exfiltrate location data, photos, and audio recordings. An exposed attacker server revealed 850+ records affecting fewer than 50 confirmed victims, with infrastructure registered as early as August 2025 using DuckDNS for domain masking. Security researchers noted hallmarks consistent with IRGC-linked spearphishing, though financial motivations have not been ruled out. Users should avoid clicking unsolicited WhatsApp links and regularly audit linked devices.