Iranian Educated Manticore Targets Leading Tech Academics

The Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, cyber security experts and computer science professors. The attackers posed as fictitious assistants to technology executives or researchers, directing victims to fake Gmail login pages or Google Meet invitations. This allowed them to intercept passwords and 2FA codes, gaining unauthorized access to victims' accounts. The group used a custom phishing kit implemented as a Single Page Application built with React, supporting various Google authentication flows and enabling 2FA relay attacks. The infrastructure relied on over 130 unique domains resolving to multiple IP addresses. Despite increased exposure, Educated Manticore continues to pose a persistent threat, particularly to individuals in Israel during the Iran-Israel conflict escalation.

• Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCampaign2026-07-06
• Iran-Nexus Disseminates MarkiRAT Surveillance ToolMalware2026-07-01
• Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying CampaignMalware2026-05-12
• Threat Brief: March 2026 Escalation of Cyber Risk Related to IranMalware2026-03-03
• Operation Olalampo: Inside MuddyWater's Latest CampaignMalware2026-02-23