Israel disclosed SpearSpecter: an IRGC-IO espionage campaign using weeks-long WhatsApp social engineering and search-ms/WebDAV abuse to deploy the fileless TAMECAT PowerShell backdoor with Discord/Telegram C2.

APT42 launched "SpearSpecter," a campaign targeting defense officials and their relatives. It uses personalized social engineering and the stealthy, PowerShell-based TAMECAT malware.

APT42 targets defense officials with "TAMECAT," a modular PowerShell backdoor. The malware uses social engineering and Telegram C2 to steal secrets.

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential theft, TAMECAT backdoor delivery Targets or victims Defense and governmen…