Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats

An Iran-nexus group is linked to a coordinated, multi-wave spear-phishing campaign targeting embassies and consulates worldwide, according to Dream. The activity is attributed to Iranian-aligned operators connected to a group known as Homeland Justice, with emails disguising legitimate diplomatic communications to harvest information and establish a foothold in diplomatic networks.

The attackers sent messages from 104 unique compromised addresses, including some from the Oman Ministry of Foreign Affairs in Paris, to embassies, consulates, and international organisations across the Middle East, Africa, Europe, Asia and the Americas. The lure content repeatedly referenced urgent MFA communications and urged recipients to enable macros via a malicious Microsoft Word document, deploying a VBA macro that installs the payload and enables persistence and C2 contact.

ClearSky also noted that similar obfuscation techniques were used by Iranian threat actors in 2023 against Mojahedin-e-Khalq in Albania, and described the operation as a broader diplomatic espionage effort amid heightened geopolitical tension. 3 September 2025.