APT42 Uses AI-Assisted Phishing and TAMECAT Malware to Target Government and Defense Officials

APT42, an Iran-linked cyber espionage group, has expanded its phishing operations with AI-assisted research, convincing personas, and a more resilient version of its TAMECAT malware.

The campaign has targeted senior government and defense officials, policy experts, and, in some cases, family members connected to high-value individuals.

Rather than relying on large volumes of suspicious emails, the group builds trust through realistic invitations, extended conversations, and messages sent through personal email, corporate accounts, and WhatsApp.

This approach makes familiar Iranian APT42 phishing group activity harder to spot before a victim clicks a link or opens a document.

Analysts at DarkAtlas identified the latest activity as a combination of relationship-based phishing, credential theft, and malware delivery.

DarkAtlas said in a report shared with Cyber Security News (CSN) that the group uses generative AI to research targets, create believable identities, translate messages, develop code, and improve its social-engineering lures.

The result is a campaign that can steal both credentials and long-term access to a victim’s device. The group’s latest TAMECAT activity shows that attackers are not depending on one delivery method, one hosting provider, or one command channel to keep an operation alive.

APT42 Uses AI-Assisted Phishing and TAMECAT Malware

The SpearSpecter campaign used professional themes such as conference invitations, interviews, and meeting documents to approach targets.

Operators reportedly spent days or weeks building rapport before sending a malicious link, making AI spear phishing risks more difficult to identify through poor grammar or generic wording alone.

In one malware path, victims were directed to a page that triggered the Windows search-ms handler and asked them to open File Explorer.

If the user approved the prompt, Explorer connected to an attacker-controlled WebDAV share, where a shortcut file disguised as a PDF waited for execution.

The shortcut then launched Command Prompt, downloaded a batch file, and used PowerShell to retrieve further components.

This chain reflects wider Windows WebDAV delivery abuse that can make remote files appear less suspicious to users who believe they are opening a normal document.

TAMECAT is more than a simple downloader. The malware can collect browser cookies and credentials, search for files, capture screenshots, access Outlook mailbox data, run commands, package stolen information, and send it out through several channels, including HTTPS, Discord, and Telegram.

The browser-cookie capability creates a serious identity risk because a password reset alone may not remove an attacker’s access.

Organizations should revoke active sessions and refresh tokens, review browser-stored credentials, and investigate suspicious sign-ins after a suspected infection.

Detection Requires Context

APT42’s phishing activity also includes credential-harvesting pages that imitate cloud document services.

In a March 2026 operation, a benign OneDrive-hosted PDF was used first to establish trust, while a later link redirected the target to an attacker-controlled login page, a tactic similar to recent OneDrive credential phishing attacks.

Security teams should review the whole conversation rather than treating a legitimate first link as proof that a sender is safe.

A sudden move from personal email to corporate email or WhatsApp, a changed document destination, or a request to sign in again should trigger verification through an independent channel.

Endpoint monitoring should focus on connected events: a browser opening search-ms, rundll32.exe using davclnt.dll to create WebDAV access, a remote LNK file launching cmd.exe, and curl or PowerShell retrieving content.

That sequence provides a stronger warning than a domain, file hash, or process event viewed alone.

High-risk users should use phishing-resistant MFA such as FIDO2 security keys or passkeys, while organizations should disable legacy authentication where possible.

Teams should also monitor unusual inbox rules, forwarding changes, new OAuth permissions, recovery-method changes, and session-token reuse following suspicious communications.

The campaign shows how patient social engineering and adaptable malware can work together against targets whose accounts and devices hold sensitive information.

Defenders need to combine email history, endpoint telemetry, identity logs, and infrastructure intelligence to determine whether an attempted approach became a compromise.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.