APT42: AI-Assisted Rapport Phishing and a More Resilient TAMECAT

Executive Summary

APT42 continues to refine a familiar operating model, making it harder to detect and easier to scale.

Three developments define the current picture. SpearSpecter combined prolonged WhatsApp engagement, Windows search-ms and WebDAV abuse, and a substantially expanded TAMECAT backdoor. APT42 also incorporated generative AI into target research, persona and pretext development, translation, malware engineering, debugging, code generation, and exploitation research. In March 2026, TA453 activity overlapping APT42 targeted a US think tank with a live credential-phishing operation during an active regional conflict.

Recent malware samples add a technical view. A 2026-dated PDF-themed shortcut, a batch controller, and an obfuscated PowerShell collection module form a probable TAMECAT-compatible chain. A fourth macro workbook carries 2021 timestamps and provides an older point of comparison.

The most important defensive conclusion is not that APT42 has acquired a revolutionary implant. It is that the group now combines four difficult-to-separate layers:

• believable, multi-message relationships built across personal email, corporate email, and WhatsApp;
• legitimate cloud services used for lures, redirects, payload staging, and command and control;
• credential theft designed to capture identity rather than merely infect an endpoint; and
• fileless or low-footprint malware used selectively when long-term host access is worth the additional exposure.

this makes brand impersonation, look-alike domain discovery, executive monitoring, credential-exposure monitoring, and contextual IOC enrichment more useful than a hash-only feed. Endpoint, email, and identity telemetry remain essential: external intelligence can identify the infrastructure and pretext, but it cannot by itself show whether a user opened a lure, approved a browser prompt, surrendered a session, or executed TAMECAT.

Quick Definition: What Is APT42?

APT42 is an Iran-linked threat actor associated with targeted phishing, credential theft, espionage, and social-engineering operations against high-value individuals and organizations.

The group is also closely associated with activity tracked as TA453 in some reporting. Its operations often rely on believable personas, trusted communication channels, and carefully staged phishing flows rather than high-volume spam.

In this report, APT42 is used as the primary actor name, TA453 is used where the activity is tracked under that label, and SpearSpecter refers to the specific campaign discussed below.

Scope and Attribution

Threat actor names often overlap across public reporting. For that reason, this analysis uses clear attribution boundaries.

This report uses:

• APT42 as the primary actor name
• TA453 for closely overlapping activity tracked under that label
• SpearSpecter for the specific campaign discussed in this analysis

An alias match alone does not prove that every operation reported under another “Kitten” name belongs to the same team.

This distinction matters because Iran-nexus activity is broad. For example, January 2026 RedKitten activity may be relevant to regional monitoring, but it should not be presented as a confirmed APT42 campaign unless supported by reliable attribution.

Recent APT42 Activity at a Glance

SpearSpecter: TAMECAT Becomes a More Capable Espionage Platform

SpearSpecter targeted senior defense and government figures and, in some cases, their family members. This was not mass phishing. Operators conducted reconnaissance, impersonated credible contacts, and built trust over days or weeks, including through WhatsApp.

Depending on the objective, victims were directed either to a credential-harvesting flow or to a TAMECAT infection chain.

SpearSpecter Malware Delivery Flow

The malware-delivery path creates several behavioral detection points before the backdoor is fully established:

1. The target receives what appears to be a meeting or conference document.
2. A crafted page invokes the Windows search-ms URI handler and asks the user to open Windows Explorer.
3. If approved, Explorer connects to an attacker-controlled WebDAV share.
4. rundll32.exe calls davclnt.dll,DavSetCookie to establish the WebDAV connection.
5. The share presents a .lnk shortcut disguised as a PDF.
6. Opening the shortcut launches cmd.exe.
7. The command shell uses curl to download a batch loader from cloud infrastructure.
8. The loader executes obfuscated PowerShell, retrieves additional modules, and runs much of the chain in memory.

The key detection opportunity is the full sequence, not one indicator. A high-confidence analytic should correlate browser invocation of search-ms, WebDAV access through rundll32.exe, a remote .lnk launching cmd.exe, and curl retrieving content that is passed to PowerShell.

This sequence makes the initial page, file extension, and final process tree more useful together than any one indicator. A broad block on OneDrive, Cloudflare Workers, Discord, or Telegram would be impractical. A higher-confidence analytic is the rare sequence of a browser invoking search-ms, rundll32.exe establishing WebDAV access, a remote .lnk launching cmd.exe, and curl retrieving content that is handed to PowerShell.

What the New TAMECAT Modules Do

TAMECAT operates as a modular surveillance and collection framework rather than a simple downloader. Its obsTAMECAT operates as a modular surveillance and collection framework, not just a downloader.

Observed capabilities include:

• Host, network, application, process, privilege, patch, and security-product discovery
• Arbitrary command execution
• Targeted file discovery and staging under %LOCALAPPDATA%\Caches
• Browser credential and cookie collection
• Outlook .ost mailbox collection
• Repeated screenshots
• Archive creation and chunked exfiltration
• Redundant command-and-control and exfiltration paths

Why TAMECAT Matters for Identity Defense

The browser module is especially important for identity defense. TAMECAT can launch Microsoft Edge off-screen with --no-sandbox and --remote-debugging-port=9222, then use the DevTools Protocol to request decrypted cookies.

It can also suspend Chrome with Sysinternals PsSuspend to release locks on browser databases before copying or parsing them.

This means a password reset may not be enough after host compromise. Responders should revoke active sessions, invalidate refresh tokens, and investigate browser-stored credentials.

Discord and Telegram C2

SpearSpecter also represents publicly documented APT42 use of Discord and Telegram for command and control alongside HTTPS.

For defenders, the important signal is not only the use of encrypted traffic. The stronger detection context is workstation PowerShell or MSXML2.serverXMLHTTP reaching messaging APIs, especially after a search-ms and WebDAV delivery chain

Malware Samples and Technical Findings

Recently observed samples provide additional insight into APT42’s malware delivery and post-compromise activity.

The sample set includes:

• A PDF-themed Windows shortcut
• A batch controller
• An obfuscated PowerShell module
• A macro-enabled Excel workbook

These samples show how APT42 continues to combine social engineering, legitimate cloud infrastructure, PowerShell execution, and modular collection logic.

Late April to May 2026 TAMECAT Activity

The central file in this activity was Document.pdf.lnk, a Windows shortcut disguised as a PDF. The file has SHA-256:

783a55c215ff18ea618f5a63936e08044448901096ee4de2d23fcda740abe104

The shortcut served as a delivery file for a TAMECAT PowerShell toehold and is linked with high confidence to an APT42 campaign likely targeting people associated with the nuclear-energy sector.

The social-engineering theme used podcast and interview invitations, continuing the group’s preference for credible professional engagement before malware delivery.

LNK Staging Locations

The shortcut was hosted at three observed locations:

• cloudfilenow[.]online:8050/file_bgeu/document.pdf.lnk
• 107.189.25[.]18:8050/file_bgeu/document.pdf.lnk
• synctimenow[.]org:8050/file_bgeu/document.pdf.lnk

An open directory on synctimenow[.]org contained timestamp and campaign-code artifacts indicating deployment on or before 25 April. The exact LNK was later submitted to VirusTotal on 16 and 18 May from Sweden, the United Kingdom, and Ukraine. Submission geography describes where copies reached the repository and does not identify the targets or operators.

When executed, the LNK sends n=88_&T=bgeuYESS to personal-store[.]netlify[.]app/yo3u, saves the response as a batch file, and uses the session key bgeu across later PowerShell communication. The batch stage opens a benign OneDrive document as a decoy while establishing contact with projects-shared[.]netlify[.]app. The confirmed batch retrieved in this chain has SHA-256 5c38af2f39802c0362a72247bfd52a35e16b93f45dfe1a2b573a2e620c8d1189.

Public web-scan records contain ten submissions for personal-store[.]netlify[.]app between 16 and 27 May. Eight used the exact /yo3u path embedded in the LNK. Initial scans returned HTTP 405, which is compatible with a browser GET request reaching an endpoint designed for the LNK’s POST request. By 21 May, later scans returned HTTP 404 with the Netlify title Site not found.

TAMECAT Resilience

This TAMECAT variant added resilience beyond the two Netlify services. One persistence component generated candidate domains from a hard-coded seed, with synctimenow[.]org observed active.

Another component retrieved Telegram bot configuration, although active Telegram C2 was not observed during analysis.

The combination gave the operators multiple recovery paths if a cloud-hosted endpoint was removed.

The recent sample set provides complementary views of APT42 delivery and post-compromise activity. The confirmed TAMECAT shortcut records the late-April execution path, two closely aligned variants expose controller and collection logic, and a macro-enabled workbook illustrates a separate Office-based route.

Sample 1: PDF-Themed LNK Delivery

A 1,196-byte shortcut was staged as Document.pdf.lnk, while its internal description is honorium-form.pdf and its icon points to Microsoft Edge. It targets C:\Windows\System32\cmd.exe, but these presentation properties are intended to make it look like a document rather than a command launcher. Its command line uses set "b=url" and c%b% to reconstruct the word curl only when cmd.exe interprets it.

The reconstructed behavior is:

1. change to %TEMP%;
2. send a silent HTTPS POST to personal-store[.]netlify[.]app/yo3u with the form values n=88_&T=bgeuYESS;
3. ignore TLS certificate validation with curl -k;
4. save the response as 8.cmd; and
5. execute the downloaded batch file through a second temporary command file.

This behavior is now confirmed as part of an APT42 TAMECAT delivery chain. The exact LNK hash, bgeuYESS tracking value, bgeu session key, /yo3u endpoint, and external staging locations were documented together in the late-April campaign. The similarity to SpearSpecter reflects continued reuse and iteration of TAMECAT delivery methods rather than attribution based only on behavioral resemblance.

Sample 2: Batch Controller

The analyzed sample closely aligns controller variant with the same campaign key, C2 service, identifier structure, OneDrive decoy behavior, and temporary PowerShell tasking pattern. It immediately alters host state if executed, piping into clip, deleting the current user’s RunMRU registry history, and launching PowerShell under conhost.exe --headless. Static review identified the following controller logic:

• C2 base URL: projects-shared[.]netlify[.]app;
• session key fragment: bgeu, which overlaps the LNK value bgeuYESS;
• polling interval: 20 seconds during normal operation and 10 seconds after an error;
• victim identifier: operating-system caption, bgeu session key, username, hostname, and a new or mid marker joined with ;; delimiters;
• transport: Base64 data in an HTTP form field named N, sent through MSXML2.ServerXMLHTTP;
• task execution: write a non-404 response to %TEMP%\<GUID>.ps1, then launch it with PowerShell and ExecutionPolicy Bypass; and
• decoy action: open Microsoft Edge to a benign OneDrive-hosted Word document.

The combination of headless conhost, PowerShell, cmd, Edge, a benign OneDrive decoy, Base64 tasking, and temporary PowerShell modules is highly consistent with the wider TAMECAT activity. It also creates more durable hunt opportunities than the Netlify hostname alone.

The documented campaign used additional persistence logic to request a batch stage from projects-shared[.]netlify[.]app/Top4d with the form values RNE2=random&INE2=. That stage generated domains from a hard-coded seed, allowing TAMECAT to recover if its primary Netlify infrastructure was removed. A separate persistence component retrieved Telegram configuration, but no active Telegram command-and-control traffic was observed during analysis.

Sample 3: Obfuscated PersistenceMonitor Module

This sample is a variant of the same PersistenceMonitor capability documented in a previous confirmed campaign. The 4,108-byte PowerShell file begins with a monoalphabetic substitution table, reconstructs a second script one character at a time, and passes the result to IEX. For safety, the substitution was reversed as text and the resulting script was not invoked.

The decoded module identifies itself as PersistenceMonitor and uses the same projects-shared[.]netlify[.]app host as the batch controller, with the path /home. It reads the registered owner and system drive, then inventories both of these per-user persistence locations:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

Results are written to %TEMP%\PersistenceMonitor.txt, Base64-encoded, split into chunks of up to 1,000,000 characters, labeled as First, Middle, End, or Overflow, and sent through an HTTP form field named Data. The temporary text file is deleted after transmission.

This is a collection and exfiltration module, not a persistence installer. Its likely purpose is to tell the operator what survives logon and which software has already registered autostart entries. That information can support follow-on tasking, conflict avoidance, or security-product discovery. The sample also contains a hard-coded victim label, Bruno_DESKTOPET51AJO, which suggests the module may have been generated or configured for a specific host.

Late-April TAMECAT chain contained a broader set of task-specific modules:

Most collection modules write results to named files, Base64-encode the content, divide it into chunks, and upload it through projects-shared[.]netlify[.]app/home. Each module uses a substitution map for obfuscation, creating a reusable family-level detection opportunity even when hashes change.

Sample 4: Macro-Enabled Workbook

An 53,118-byte OOXML archive contains xl/vbaProject.bin, a hidden worksheet, an embedded Paint bitmap, and two scripts stored as shared worksheet strings. The visible sheet displays an Office compatibility error and instructs the user to select Enable Editing and Enable Content. The embedded OLE object resolves to Paint.Picture.1 and contains bitmap data, not an executable payload.

The Workbook_Open macro runs automatically when macros are enabled. It uses URLDownloadToFileA, retrieves the username, and writes several files under %APPDATA%, including:

• Microsoft\Windows\Start Menu\Programs\Startup\date.bat, which launches %APPDATA%\txt.bat at logon;
• txt.bat, a registry-based PowerShell launcher;
• ni.txt, used later as a host token; and
• set.txt, downloaded from hsta[.]xyz.

The macro presents a prompt asking whether to enable content, but both Yes and No branches write payload material and download content. The Yes branch additionally reveals the hidden sheet. One worksheet script stores a UTF-16LE Base64 PowerShell controller in HKCU\Software\Classes\Key and creates a RunOnce value named systemUpdating to decode it.

The decoded controller contacts 1thebstack1[.]xyz/Api/Session every three seconds. It identifies itself as PowerWindows, reads the token from %APPDATA%\Ni.txt, and accepts Base64 tasking for arbitrary PowerShell and in-memory C# execution. Its use of wildcard command resolution, inserted junk text in powershell, registry-stored Base64, and a hidden worksheet are all static obfuscation and persistence signals.

Indicators and Confidence Boundaries

The strongest conclusion is no longer based only on behavioral similarity. The exact LNK and its infrastructure are attributed to APT42 with high confidence, and the chain is assessed as a TAMECAT campaign likely targeting the nuclear-energy sector.

The locally analyzed batch and PersistenceMonitor files should be treated as variant-level matches because their hashes differ from the confirmed downstream files. This distinction keeps the attribution strong without claiming that all local files came from one live execution.

APT42’s Practical Use of Generative AI

APT42 appears to use generative AI as an operational accelerator, not as a fully autonomous intrusion system.

Observed uses include:

• Identifying official email addresses and researching entities of interest
• Investigating potential partners or affiliations for believable pretexts
• Turning target biographies into plausible personas or engagement scenarios
• Translating and localizing language for the intended audience
• Generating and debugging code
• Developing specialized tooling
• Researching exploitation techniques

Why AI Changes Phishing Detection

Language quality is now a weak phishing indicator.

APT42 already relied on rapport-building, multi-message engagement, and believable social engineering. Generative AI makes it easier to sustain a coherent persona across multiple messages, languages, and communication channels.

Organizations should verify the relationship and the request, not only the writing quality.

Useful checks include:

• Does the final document link move from a trusted platform to an unrelated domain?
• Does the sender’s address match the claimed institution?
• Does the proposed event exist on an official channel?
• Did the conversation unexpectedly move from personal email to corporate email or WhatsApp?

March 2026: Targeted TA453 Activity During the US-Iran Conflict

On 8 March 2026, eight days after US and Israeli strikes inside Iran began the conflict, TA453 targeted a US think-tank employee with a credential-phishing operation. The email thread had started in February with a benign invitation sent to the target’s personal account, then expanded to corporate accounts after the conflict began.

This is confirmed targeted activity during the war, but the chronology matters. The approach began before the fighting, so the evidence does not show that the campaign was created in response to the conflict. Instead, it shows that an existing APT42-aligned intelligence operation continued during the war and remained focused on a strategically relevant air-defense theme.

The conflict also appears to have reached physical infrastructure associated with the wider IRGC phishing operation. On 23 March, strike damage was reported on Malekloo Street in eastern Tehran. Open-source imagery identified the damaged building as the Malekloo Office, a location previously connected to IRGC cyber operators Masoud Jalili, Seyyed Ali Aghamiri, and Yaser Balaghi. The office had eight static IP addresses and high-speed external connectivity, supporting phishing operations against US officials, journalists, policy organizations, and political campaigns. The three operators were charged in 2024 over a campaign using forged identities, spoofed login pages, stolen accounts, credential harvesting, and attempts to capture multifactor authentication codes. The same election-related targeting pattern has been independently tracked as APT42.

The attacker used McManus.Michael@hotmail[.]com to impersonate Michael McManus, head of research at the Henry Jackson Society. The pretext was a roundtable on air defense in the Middle East. To make the invitation credible, the sender first provided a benign PDF through a genuine Microsoft OneDrive link. Only after rapport was established did the actor send a malicious link disguised as another event PDF.

credible identity → benign conversation → genuine cloud-hosted document → attacker-controlled redirect → cloud-hosted credential phish

This chain defeats simplistic advice such as “check whether the first link is Microsoft.” It also demonstrates why external brand and domain monitoring should be joined with email and identity telemetry. A newly registered or low-reputation redirector can be detected externally; the pre-filled email, successful credential submission, subsequent sign-in, and session changes require internal visibility.

IOCs:

The genuine 1drv.ms link hosted the benign lure and should not be treated as malicious platform-wide.

Detection and Hunting Priorities

Email, Persona, and Brand Layer

• Monitor look-alike domains and newly created domains combining the organization, executive names, conference terminology, and file-transfer language.
• Alert on freemail accounts impersonating executives, researchers, journalists, event organizers, or known partners.
• Review conversations that begin on a personal account and later introduce a corporate account or WhatsApp number.
• Treat a benign first-stage document as part of the trust-building sequence, not proof of sender legitimacy.
• Expand executive and high-risk-person monitoring to family members and assistants where policy and consent allow; SpearSpecter explicitly broadened targeting beyond the primary individual.

Endpoint Layer

• Detect browsers or Office applications invoking search-ms: followed by Explorer or WebDAV activity.
• Correlate rundll32.exe with davclnt.dll,DavSetCookie, especially when the remote host is internet-based.
• Alert when a .lnk obtained from WebDAV launches cmd.exe, curl.exe, or PowerShell.
• Detect .lnk arguments that reconstruct curl through environment-variable expansion, especially when a POST response is saved as .cmd under %TEMP%.
• Hunt for retrieval of document.pdf.lnk from port 8050, especially under /file_bgeu/, followed by cmd.exe, curl.exe, or creation of 8.cmd in a temporary directory.
• Alert on conhost.exe --headless powershell, particularly after deletion of HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU or immediately before periodic XMLHTTP traffic.
• Detect Base64 client identifiers containing the sequence ;;bgeu;; and ending in ;;new or ;;mid in PowerShell-driven form posts.
• Hunt for POST requests to /Top4d carrying RNE2=random&INE2= and repeated chunk uploads to /home.
• Hunt for Base64 form posts using the fields N or Data when PowerShell or MSXML2.ServerXMLHTTP communicates with non-enterprise Netlify subdomains.
• Review creation and deletion of %TEMP%\PersistenceMonitor.txt together with PowerShell access to the current user’s Run and RunOnce keys.
• Hunt for PowerShell persistence loading randomly named text files under %LOCALAPPDATA%\Microsoft\Windows\AutoUpdate.
• Detect msedge.exe --no-sandbox --remote-debugging-port=9222, particularly when hidden or positioned off-screen.
• Detect PsSuspend use against Chrome followed by access to Login Data, Network\Cookies, or Web Data.
• Review creation of %LOCALAPPDATA%\Caches\ALL*.txt, FileCrawler.txt, browser-cookie JSON, staged archives, or repeated screenshot files.
• Investigate PowerShell or XMLHTTP clients communicating directly with Discord or Telegram APIs.

Identity and Cloud Layer

• Require phishing-resistant MFA such as FIDO2 security keys or passkeys for high-risk users; one-time codes do not stop real-time relay.
• Disable legacy authentication and app passwords where operationally possible.
• Alert on new geographic or device sign-ins soon after a suspicious conversation or link click.
• Monitor new inbox rules, forwarding, OAuth grants, recovery-method changes, and session-token reuse.
• After suspected TAMECAT access, revoke sessions and refresh tokens in addition to resetting passwords.
• Include personal accounts used for official work in executive security guidance, because APT42 deliberately crosses the personal/corporate boundary.

How DarkAtlas Can Operationalize This Intelligence

APT42’s current tradecraft aligns with four DarkAtlas capability areas. Each capability has a clear role and a clear boundary.

This is also a useful model for prioritizing alerts. A single newly registered domain resembling a customer’s brand may be low confidence. The same domain becomes high priority when it impersonates a monitored executive, appears in a conversation with a high-risk employee, redirects to a cloud-hosted login clone, or is linked to a sample whose behavior matches the TAMECAT chain.

DarkAtlas’s Threat Intelligence offering supports IOC, YARA/Sigma, threat-actor, and manual-malware-analysis workflows. Its Brand Protection capability covers phishing-site, impersonation, executive, and typosquatting monitoring. Attack Surface Management and Dark Web Monitoring provide the complementary exposure view.

Conclusion

APT42 remains an intelligence-collection threat whose advantage comes from patient human targeting, now accelerated by AI and supported by more resilient malware when needed.

The recent TAMECAT activity shows that the group continues to evolve its delivery, persistence, and recovery options. SpearSpecter increased the technical depth of the malware chain, but the actor still depends on the victim accepting a relationship, opening a prompt, clicking a link, or submitting credentials.

That dependency creates defensive opportunities.

The strongest control set is not a static blocklist. It is the correlation of external impersonation and infrastructure intelligence with email history, endpoint process chains, identity events, and cloud telemetry.

DarkAtlas can support the external intelligence and enrichment layers, while customer-side email, EDR, identity, and cloud logs determine whether an attempted approach became a compromise.