Iran-Linked APT42 Uses AI

Gbhackers •Mayura Kathir • July 21, 2026

Iran-linked APT42 is escalating its espionage operations with AI-assisted phishing and an expanded TAMECAT backdoor, enabling long-lived access to defense and government identities rather than just endpoints. Recent activity shows tightly integrated social engineering, cloud abuse, and fileless PowerShell tradecraft that significantly complicate detection and response. APT42, also tracked as TA453 in some reporting, is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT42 Expands AI-Assisted Phishing Operations Targeting Government Officials Iran-linked APT42 has intensified its cyber espionage efforts by utilizing AI-assisted phishing techniques and an upgraded version of its TAMECAT malware. The group is now targeting high-profile government and defense officials, as well as their family members, using convincing personas and advanced social engineering tactics. This campaign marks a shift from traditional phishing methods to more sophisticated approaches that complicate detection and response. The TAMECAT backdoor has been enhanced for long-term access, focusing on sensitive identities rather than just endpoints. The integration of cloud abuse and fileless PowerShell techniques further increases the complexity of the attacks. Recent reports indicate that APT42 is leveraging AI for more effective reconnaissance and targeting. The current status of the campaign suggests ongoing activity with no immediate resolution in sight. 4 sources 74

Extracted Entities

Iran-Linked APT42 Uses AI

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Industries (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)