APT42 Uses AI

Cybersecuritynews •Tushar Subhra Dutta • July 21, 2026

APT42, an Iran-linked cyber espionage group, has expanded its phishing operations with AI-assisted research, convincing personas, and a more resilient version of its TAMECAT malware. The campaign has targeted senior government and defense officials, policy experts, and, in some cases, family members connected to high-value individuals. Rather than relying on large volumes of suspicious emails, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT42 Expands AI-Assisted Phishing Operations Targeting Government Officials Iran-linked APT42 has intensified its cyber espionage efforts by utilizing AI-assisted phishing techniques and an upgraded version of its TAMECAT malware. The group is now targeting high-profile government and defense officials, as well as their family members, using convincing personas and advanced social engineering tactics. This campaign marks a shift from traditional phishing methods to more sophisticated approaches that complicate detection and response. The TAMECAT backdoor has been enhanced for long-term access, focusing on sensitive identities rather than just endpoints. The integration of cloud abuse and fileless PowerShell techniques further increases the complexity of the attacks. Recent reports indicate that APT42 is leveraging AI for more effective reconnaissance and targeting. The current status of the campaign suggests ongoing activity with no immediate resolution in sight. 4 sources 74

Extracted Entities

APT42 Uses AI

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)