New Phishing Attacks Targeting Professors and Writers in the Middle East

Writers and professors from the Middle East have been targeted by a phishing campaign carried out by cyber criminals using SpoofedScholars, according to a new Proofpoint report. The attack employs a University of London website to steal data from targeted individuals, says Tech Republic. 

The School of Oriental and African Studies at the University of London has over 5,200 undergraduate and postgraduate students on campus, as well as almost 300 lecturers who specialize in the study of the Middle East, Africa, and Asia. After infiltrating the radio station's website, a malicious group was able to develop a credential harvesting page masquerading as a registration interface.

The thread actor pretends to be a professor at the university's School of Oriental and African Studies in London. Afterwards, the scam artist invites the targeted individual to an online conference using the professor's identity. The main goal of the scam scheme is to communicate with its victims via video conference or phone call and gather sensitive information from them.

The phishing attacks are allegedly carried out by state-sponsored cyber criminals from Iran 

Cybersecurity specialists have uncovered that an Iranian state-sponsored threat actor known as TA453 is responsible for the attacks. The threat actor is taking advantage of free email providers to impersonate individuals known to their targets in order to increase the likelihood of successfully compromising their systems.

Furthermore, TA453's fraud scheme uses credential phishing operations to obtain information by exfiltrating sensitive emails and contacts or enabling initial access for further phishing attempts. Proofpoint has notified the authorities in order to alert the affected universities of the breach.

According to the findings of this report, the majority of the targets (less than 10 organizations) had previously been targeted by the gang. Unfortunately, cybersecurity researchers concluded that the group's scheme will most likely be used in other attacks in the future.