Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation
Summary: Unit 42 identified suspected Iranian infrastructure impersonating the Hamburg-based Mega Model Agency through the domain megamodelstudio[.]com, registered Feb. 18, 2025, and resolving to 64.72.205[.]32 since March 1, 2025. The cloned site runs obfuscated JavaScript to harvest device- and network-specific visitor details and swaps in a fictitious model profile named "Shir Benzion" with a non-functional private album link, which Unit 42 assesses is a placeholder for targeted social engineering.
What you should know: Unit 42 attributes the campaign with lower confidence to a group overlapping Agent Serpens, also known as APT35 or Charming Kitten, which is known for espionage against Iranian dissidents, journalists and activists abroad - so anyone supporting those communities is the intended target, and the fake profile is still waiting to be armed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026