{"id":657,"date":"2020-09-04T17:32:59","date_gmt":"2020-09-04T17:32:59","guid":{"rendered":"https:\/\/kdmarc.com\/blog\/?p=657"},"modified":"2024-08-14T15:30:45","modified_gmt":"2024-08-14T10:00:45","slug":"charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback","status":"publish","type":"post","link":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/","title":{"rendered":"Charming Kitten Made a Comeback Using WhatsApp and LinkedIn"},"content":{"rendered":"<p style=\"text-align: justify;\"><span style=\"font-weight: 400; color: #000000;\">The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp. In its new approach, it impersonates Persian-speaking journalists on these social media platforms to trick victims into opening malicious links. <\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"font-weight: 400; color: #000000;\">Charming kitten is mainly aiming to launch cyber attacks on Israeli scholars from Haifa and Tel Aviv Universities and U.S. government employees.&nbsp;<\/span><span style=\"font-weight: 400; color: #000000;\">Security analysts have claimed that the first malicious activity by Charming Kitten was recorded in July. <\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"font-weight: 400; color: #000000;\">Hackers have been falsely posing as popular writers for the Deutsche Welle and Jewish Journal outlets. They were perpetrating attacks on potential victims via malicious emails, and WhatsApp messages and calls. <\/span><span style=\"font-weight: 400; color: #000000;\">Furthermore, these cybercriminals have created fake LinkedIn profiles registered in the names of well-known journalists to deceive their victims. <\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"font-weight: 400; color: #000000;\">Their ultimate agenda is to manipulate victims into clicking on malicious links that would redirect them to a spoofed login page wherein they would be requested to submit their credentials.&nbsp;<\/span><\/p>\n\n<style type=\"text\/css\">\n      @media print, screen and (max-width: 63.99875em){\n      .tnp-submit\n      width: 48%;\n      }\n      .wp-block-tnp-minimal{\n      padding: 20px;\n      }\n      .blog_para\n      margin-top: 4px !important;\n      line-height: 25px !important;\n      font-size: 15px !important;\n      }\n\n      }\n      .blog_para{\n      font-family: jost,sans-serif;\n      margin-top: 14px;\n      margin-bottom: 30px;\n      color: #fff;\n      font-size: 15px !important;\n      color: black !important;\n\n      }\n\n      .wp-block-tnp-minimal{\n      padding:20px;\n      border: 1px solid grey;\n      }\n\n      .tnp-submit a{\n        background: #1d58c7!important;\n    border-radius: 5px!important;\n    text-transform: inherit!important;\n    padding: 8px 25px!important;\n    font-weight: 600!important;\n    color: #fff!important;\n    width: 30%!important;\n    border: none;\n      }\n\n      .blog_get{\n      font-size: 24px !important;\n      font-weight: 700;\n      padding-bottom: 0px;\n    font-family: 'Poppins' !important;\n      margin-bottom: 0px;\n      margin-top: 0px;\n      margin-bottom: 0px !important;\n      color: white;\n          line-height: 30px;\n          color: white;\n      }\n      .row{\n             display: flex;\n    flex-wrap: wrap;\n    flex-direction: row;\n    padding: 25px 0px 25px 36px;\n    align-items: center;\n\n      }\n\n.colLeft{\n         flex-basis:50%;\n    -webkit-box-flex: 0;\n    flex-grow: 0;\n    max-width: 50%;\n    color: white;\n}\n    \n .colRight{\n       flex-basis: 45%;\n    -webkit-box-flex: 0;\n    flex-grow: 0;\n    max-width: 50%;\n }\n\n.tnp-subscription-minimal{\n    float: right;\n}\n<\/style>\n<div style=\"max-width: 741px; margin: 0 auto; background-image: url('https:\/\/awareness.threatcop.ai\/marketing\/linkedinlowerbanner.webp'); background-repeat: no-repeat; background-size: cover; background-position: center; \">\n<div class=\"row\">\n<div class=\"colLeft\">\n<p class=\"blog_get\" style=\"font-family: 'Poppins' !important; color: white !important\">Subscribe to Our Newsletter On Linkedin<\/p>\n<p class=\"blog_para\" style=\"font-size: 16px;font-family: 'Poppins' !important; color: white !important; margin-top: 10px; margin-bottom: 28px;line-height: 25px;\">Sign up to Stay Tuned with the Latest Cyber Security News and Updates<\/p>\n\n<div>\n<div class=\"tnp\" style=\"margin-bottom: 10px;\">\n            <form action=\"https:\/\/threatcop.com\/newsletter-thank-you\" method=\"get\" target=\"_blank\">\n<div class=\"tnp-submit\">\n                  <a class=\"libutton\" href=\"https:\/\/www.linkedin.com\/build-relation\/newsletter-follow?entityUrn=7062043746430783488\" target=\"_blank\" rel=\"noopener\">Subscribe<\/a><\/div>\n<\/form><\/div>\n<\/div>\n<\/div>\n<div class=\"colRight\">\n<div>\n<div class=\"tnp tnp-subscription-minimal \">\n            <img decoding=\"async\" src=\"https:\/\/awareness.threatcop.ai\/marketing\/newsletter-icon.webp\" class=\"img-fluid\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h1 class=\"wp-block-heading\"><span style=\"color: #000000;\"><b>How was the Attack Perpetrated?<\/b><\/span><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Pretending to be writers of German and Persian origin, the cybercriminals created fake LinkedIn profiles. They sent out LinkedIn messages to victims on their personal accounts in order to manipulate them. <\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">By taking up the names of popular journalists and writers on their fake social media handles, these hackers made sure that the victims felt that the messages were coming from reliable sources.&nbsp;<\/span><\/p>\n\n\n\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n<title>Threatcop \u2013 Book a Free Demo<\/title>\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Outfit:wght@300;400;500;600;700&#038;display=swap\" rel=\"stylesheet\">\n<style>\n  .tc-wrap , .tc-wrap ::before, .tc-wrap ::after { box-sizing: border-box; margin: 0; padding: 0; }\n  .tc-wrap { font-family: 'Outfit', sans-serif; width: 100%; display: flex; justify-content: center; padding: 20px 10px; }\n  .tc-card { width: 100%; max-width: 820px; background: #fff; border-radius: 20px; overflow: hidden; box-shadow: 0 20px 60px rgba(24,57,148,0.13), 0 4px 16px rgba(24,57,148,0.07); display: flex; flex-direction: row; }\n  .tc-left { background: linear-gradient(160deg, #1e44b0 0%, #183994 40%, #0e2570 100%); width: 320px; flex-shrink: 0; padding: 40px 32px; display: flex; flex-direction: column; justify-content: center; position: relative; overflow: hidden; }\n  .tc-left::before { content: ''; position: absolute; inset: 0; background-image: radial-gradient(rgba(255,255,255,0.08) 1.5px, transparent 1.5px); background-size: 22px 22px; }\n  .tc-left::after { content: ''; position: absolute; bottom: -60px; right: -60px; width: 220px; height: 220px; background: radial-gradient(circle, rgba(99,179,255,0.22) 0%, transparent 65%); border-radius: 50%; pointer-events: none; }\n  .tc-panel-inner { position: relative; z-index: 1; }\n  .tc-badge { display: inline-flex !important; align-items: center !important; gap: 6px; background: rgba(255,255,255,0.1) !important; border: 1px solid rgba(255,255,255,0.18) !important; border-radius: 20px !important; padding: 4px 14px 4px 10px !important; font-size: 12.5px !important; font-weight: 600 !important; letter-spacing: .09em !important; text-transform: uppercase !important; color: rgba(255,255,255,0.85) !important; margin-bottom: 18px !important; font-family: 'Outfit', sans-serif !important; line-height: 1.4 !important; }\n  .tc-badge-dot { width: 6px; height: 6px; background: #5cd9a0; border-radius: 50%; box-shadow: 0 0 6px #5cd9a0; flex-shrink: 0; display: inline-block; }\n  .tc-left h1, .tc-left h2, .tc-left h3, .tc-left h4, .tc-left h5, .tc-left h6 { color: #ffffff !important; font-family: 'Outfit', sans-serif !important; font-size: 28px !important; font-weight: 700 !important; line-height: 1.35 !important; letter-spacing: -0.3px !important; margin: 0 !important; padding: 0 !important; background: none !important; -webkit-text-fill-color: #ffffff !important; }\n  .tc-left h2 em { font-style: normal !important; color: #7ec8ff !important; -webkit-text-fill-color: #7ec8ff !important; }\n  .tc-left p, .tc-left .tc-sub { color: rgba(255,255,255,0.78) !important; -webkit-text-fill-color: rgba(255,255,255,0.78) !important; font-family: 'Outfit', sans-serif !important; font-size: 14px !important; font-weight: 300 !important; line-height: 1.65 !important; margin-top: 12px !important; background: none !important; }\n  .tc-right { flex: 1; padding: 32px 32px 28px; display: flex; flex-direction: column; justify-content: center; }\n  .tc-form-title { font-size: 13px !important; font-weight: 600 !important; letter-spacing: .12em; text-transform: uppercase; color: #8fa4cc !important; margin-bottom: 20px !important; display: flex !important; align-items: center !important; gap: 10px; font-family: 'Outfit', sans-serif !important; }\n  .tc-form-title::after { content: ''; flex: 1; height: 1px; background: #eef1fa; }\n  .tc-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 14px; }\n  .tc-field { display: flex; flex-direction: column; gap: 5px; }\n  .tc-field.full { grid-column: 1 \/ -1; }\n  .tc-field label { font-size: 13px !important; font-weight: 600 !important; color: #3a4f7a !important; letter-spacing: .04em; text-transform: uppercase; font-family: 'Outfit', sans-serif !important; display: block !important; }\n  .tc-input-wrap { position: relative; display: flex; align-items: center; }\n  .tc-input-wrap .tc-fi { position: absolute; right: 12px; width: 15px; height: 15px; stroke: #c0ccdf; stroke-width: 1.8; pointer-events: none; fill: none; }\n  .tc-wrap input[type=\"text\"], .tc-wrap input[type=\"email\"], .tc-wrap input[type=\"number\"] { width: 100% !important; border: 1.5px solid #e2e9f7 !important; border-radius: 10px !important; padding: 9px 34px 9px 13px !important; font-family: 'Outfit', sans-serif !important; font-size: 15px !important; font-weight: 400 !important; color: #1e2d50 !important; background: #f8faff !important; outline: none !important; transition: border-color .2s, background .2s, box-shadow .2s; -moz-appearance: textfield; box-shadow: none !important; -webkit-text-fill-color: #1e2d50 !important; }\n  .tc-wrap input[type=\"number\"]::-webkit-inner-spin-button, .tc-wrap input[type=\"number\"]::-webkit-outer-spin-button { -webkit-appearance: none; }\n  .tc-wrap input::placeholder { color: #c0ccdf !important; -webkit-text-fill-color: #c0ccdf !important; opacity: 1; }\n  .tc-wrap input:focus { border-color: #183994 !important; background: #fff !important; box-shadow: 0 0 0 3.5px rgba(24,57,148,0.1) !important; }\n  .tc-phone-row { display: flex; gap: 8px; }\n  .tc-flag-select { position: relative; flex-shrink: 0; }\n  .tc-flag-select select { appearance: none !important; -webkit-appearance: none !important; border: 1.5px solid #e2e9f7 !important; border-radius: 10px !important; padding: 9px 26px 9px 12px !important; font-family: 'Outfit', sans-serif !important; font-size: 14px !important; font-weight: 500 !important; color: #1e2d50 !important; background: #f8faff !important; outline: none !important; cursor: pointer; width: 100px !important; transition: border-color .2s, box-shadow .2s; }\n  .tc-flag-select select:focus { border-color: #183994 !important; box-shadow: 0 0 0 3.5px rgba(24,57,148,0.1) !important; }\n  .tc-flag-select::after { content: ''; position: absolute; right: 10px; top: 50%; transform: translateY(-50%); width: 0; height: 0; border-left: 4px solid transparent; border-right: 4px solid transparent; border-top: 5px solid #a0b0cc; pointer-events: none; }\n  .tc-phone-row .tc-input-wrap { flex: 1; }\n  .tc-btn-submit { width: 100% !important; margin-top: 18px !important; padding: 11px !important; background: #183994 !important; border: none !important; border-radius: 10px !important; color: #fff !important; -webkit-text-fill-color: #fff !important; font-family: 'Outfit', sans-serif !important; font-size: 15px !important; font-weight: 600 !important; letter-spacing: .05em; cursor: pointer; display: flex !important; align-items: center !important; justify-content: center !important; gap: 9px; transition: background .2s, transform .15s, box-shadow .2s; box-shadow: 0 6px 24px rgba(24,57,148,0.28) !important; text-decoration: none !important; }\n  .tc-btn-submit:hover { background: #1d46b5 !important; transform: translateY(-1px); box-shadow: 0 10px 32px rgba(24,57,148,0.35) !important; color: #fff !important; }\n  .tc-btn-submit:active { transform: translateY(0); }\n  .tc-btn-submit svg { width: 16px; height: 16px; stroke: #fff; stroke-width: 2.2; fill: none; flex-shrink: 0; }\n  .tc-trust { margin-top: 10px !important; display: flex !important; align-items: center !important; justify-content: center !important; gap: 5px; font-size: 13px !important; color: #a0b0cc !important; font-family: 'Outfit', sans-serif !important; }\n  .tc-trust svg { width: 12px; height: 12px; stroke: #a0b0cc; stroke-width: 2; fill: none; flex-shrink: 0; }\n  @media (max-width: 680px) {\n    .tc-card { flex-direction: column !important; }\n    .tc-left { width: 100% !important; padding: 28px 24px 24px !important; }\n    .tc-right { padding: 24px 20px !important; }\n    .tc-grid { grid-template-columns: 1fr !important; }\n    .tc-field.full { grid-column: 1 !important; }\n  }\n<\/style>\n\n<div class=\"tc-wrap\">\n  <div class=\"tc-card\">\n    <div class=\"tc-left\">\n      <div class=\"tc-panel-inner\">\n        <div class=\"tc-badge\">\n          <span class=\"tc-badge-dot\"><\/span>\n          People Security Management\n        <\/div>\n        <h2>Book a Free<br><em>Demo Call<\/em><br>with Our Expert<\/h2>\n        <p class=\"tc-sub\">Discover how Threatcop protects your workforce from modern cyber threats.<\/p>\n      <\/div>\n    <\/div>\n    <div class=\"tc-right\">\n      <div class=\"tc-form-title\">Your Details<\/div>\n      <form action=\"https:\/\/threatcop.com\/thankyou-blog\" method=\"get\" target=\"_blank\">\n        <input type=\"hidden\" name=\"BlogForm\" value=\"BlogForm\">\n        <input type=\"hidden\" name=\"PageSource\" id=\"tc-page-source\" value=\"\">\n        <div class=\"tc-grid\">\n          <div class=\"tc-field\">\n            <label>Full Name<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"text\" name=\"FullName\" placeholder=\"Jane Smith\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><circle cx=\"12\" cy=\"8\" r=\"4\"><\/circle><path d=\"M4 20c0-4 3.58-7 8-7s8 3 8 7\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field\">\n            <label>Company Name<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"text\" name=\"CompanyName\" placeholder=\"Acme Corp\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"3\" y=\"3\" width=\"18\" height=\"18\" rx=\"2\"><\/rect><path d=\"M9 3v18M3 9h6M3 15h6\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field full\">\n            <label>Corporate Email<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"email\" name=\"email\" placeholder=\"jane@yourcompany.com\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"2\" y=\"4\" width=\"20\" height=\"16\" rx=\"2\"><\/rect><polyline points=\"2,4 12,13 22,4\"><\/polyline><\/svg>\n            <\/div>\n          <\/div>\n          <div class=\"tc-field full\">\n            <label>Phone Number<\/label>\n            <div class=\"tc-input-wrap\">\n              <input type=\"number\" name=\"Phone\" placeholder=\"98765 43210\" required=\"\">\n              <svg class=\"tc-fi\" viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><path d=\"M22 16.92v3a2 2 0 01-2.18 2A19.79 19.79 0 013.09 4.18 2 2 0 015.07 2h3a2 2 0 012 1.72c.13.96.36 1.9.71 2.81a2 2 0 01-.45 2.11L9.09 9.91a16 16 0 006 6l1.27-1.27a2 2 0 012.11-.45c.91.35 1.85.58 2.81.71A2 2 0 0122 16.92z\"><\/path><\/svg>\n            <\/div>\n          <\/div>\n        <\/div>\n        <button type=\"submit\" class=\"tc-btn-submit\">\n          <svg viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><path d=\"M22 2L11 13M22 2L15 22l-4-9-9-4 20-7z\"><\/path><\/svg>\n          Book My Free Demo\n        <\/button>\n        <div class=\"tc-trust\">\n          <svg viewBox=\"0 0 24 24\" stroke-linecap=\"round\"><rect x=\"3\" y=\"11\" width=\"18\" height=\"11\" rx=\"2\"><\/rect><path d=\"M7 11V7a5 5 0 0110 0v4\"><\/path><\/svg>\n          Your data is safe &amp; never shared with third parties\n        <\/div>\n      <\/form>\n    <\/div>\n  <\/div>\n<\/div>\n<script>document.getElementById('tc-page-source').value = window.location.href;<\/script>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">The fraudulent link was enclosed within an authorized Deutsche Welle domain, making it even more difficult to detect the fraud.&nbsp; Attempts were also made to send a malicious ZIP file along with the message that was sent to the victim via the forged LinkedIn profiles.&nbsp;<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">The attack was also perpetrated via WhatsApp, where the cyber attackers talked to the victims personally via WhatsApp calls, manipulating them into clicking on malicious links. Making use of these two social media platforms, it was more convenient for hackers to reach their victims.&nbsp;<\/span><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/media.threatpost.com\/wp-content\/uploads\/sites\/103\/2019\/02\/04145647\/APT_Kitten_APT.png\" alt=\"Charming Kitten \"\/><figcaption class=\"wp-element-caption\"><span style=\"color: #000000;\">(Source: Threatpost)<\/span><\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\"><span style=\"color: #000000;\"><b>Charming Kitten&#8217;s New Attempts to Con Victims<\/b><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Charming Kitten has been active since 2014 and has always relied on email and messages to carry out its malicious activities. Also known as Ajax or APT35, this gang of Iranian hackers uses spear-phishing as their attack vector in the majority of cases. The group recently tried to hack into the email accounts tied to the 2020 Trump re-election campaign as well.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">However, hackers recently changed their course of action by relying on social media platforms such as WhatsApp and LinkedIn. They misused these platforms to support their spear-phishing email campaign to make it all look to have come from legitimate sources. <\/span><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">In the spear phishing emails, hackers of the Charming Kitten group impersonated Deutsche Welle journalists, fluent in Farsi, to deceive targeted receivers. Other victims received spoofed emails that impersonated an Israeli scholar from Tel Aviv University, requesting recipients to join a Zoom meeting in Hebrew. <\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">Hackers also posed as journalists from the Jewish Journal, requesting victims who were all mainly university students, to join a webinar on \u201ccitizenship and freedom of girls and women in Iran and its future.\u201d&nbsp;<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">The attackers made sure that they gained the trust of the victims by keeping them in a conversational loop in the webinar. They deployed various tactics to increase the interest of the victims by nominating them as the main speaker of the webinar.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">After establishing a cordial relationship with them, the cyber attackers invited them to connect over WhatsApp. The conversation was further extended and the victims didn\u2019t suspect any evil intention since the number used by the hackers was a legitimate German number (with the prefix +49).&nbsp;<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">After the attackers were sure that they had successfully gained the trust of their victims, the second wave of messages sent by them included emails with malicious links. When targets clicked on the link, they were redirected to Akademie AW&#8217;s spoofed landing page. <\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"font-weight: 400; color: #000000;\">There they were asked to sign up on the page to activate their accounts. Reportedly, researchers have traced back the malicious links to be linked to an authorized Deutsche Welle domain!<\/span><\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span style=\"color: #000000;\"><b>Keep Your Employees\u2019 Email Accounts Secured<\/b><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"font-weight: 400;\">Due to the rampant increase in the number of<\/span> email spoofing activities<span style=\"font-weight: 400;\">, it is imperative for CISOs, CIOs, and other security equivalents to implement robust<\/span> email authentication protocols<span style=\"font-weight: 400;\">. Making these protocols a part of the company\u2019s<\/span> email security help in securing your <span style=\"font-weight: 400;\">email domain against email-based attacks such as spoofing and BEC attacks.<\/span><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><span style=\"color: #0000ff;\"><a style=\"color: #0000ff;\" href=\"https:\/\/threatcop.com\/blog\/what-is-dmarc\/\" target=\"_blank\" rel=\"noopener noreferrer\"><b><span style=\"color: #183994;\">DMARC<\/span><\/b><\/a><\/span><\/span> <span style=\"color: #000000;\">is the best email authentication standard, which in alignment with <span style=\"color: #183994;\"><strong><a style=\"color: #183994;\" href=\"https:\/\/threatcop.com\/blog\/spf-and-dkim\/\">DKIM and <\/a><\/strong><\/span><span style=\"color: #0000ff;\"><span style=\"color: #183994;\"><strong>SPF<\/strong><\/span><a style=\"color: #0000ff;\" href=\"https:\/\/kdmarc.com\/blog\/spf-an-authentication-technique-for-dmarc\/\" target=\"_blank\" rel=\"noopener noreferrer\"><span style=\"color: #000000;\">,<\/span><\/a>&nbsp;<span style=\"color: #000000;\">not only secures the email domain against malicious activities but also enhances the email deliverability rate.&nbsp; In fact, <span style=\"color: #0000ff;\"><strong><a style=\"color: #0000ff;\" href=\"https:\/\/threatcop.com\/tdmarc\"><span style=\"color: #183994;\">TDMARC<\/span><\/a><\/strong><\/span> is the most recommended tool to configure DMARC in your organization.&nbsp;<\/span><\/span><\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"color: #000000;\"><strong>TDMARC offers the following benefits:&nbsp;<\/strong><\/span><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"color: #414141;\"><strong>Secures email domains from being exploited by threat actors<\/strong><\/span><\/li>\n\n\n\n<li><span style=\"color: #414141;\"><strong>Identifies all the top sources abusing your domain<\/strong><\/span><\/li>\n\n\n\n<li><span style=\"color: #414141;\"><strong>Protects brand reputation, customer base, and business<\/strong><\/span><\/li>\n\n\n\n<li><span style=\"color: #414141;\"><strong>Improves email deliverability and boosts engagement rate<\/strong><\/span><\/li>\n\n\n\n<li><span style=\"color: #414141;\"><strong>Gives full insight into email channels including third-party emails and abuse<\/strong><\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp. In its new approach, it impersonates Persian-speaking journalists on these social media platforms to trick victims into opening malicious links. Charming kitten is mainly aiming to launch cyber attacks on Israeli scholars from Haifa and Tel Aviv [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":7461,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[41],"tags":[],"class_list":["post-657","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-attacks"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Charming Kitten Resurfaces on WhatsApp and LinkedIn<\/title>\n<meta name=\"description\" content=\"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Charming Kitten Resurfaces on WhatsApp and LinkedIn\" \/>\n<meta property=\"og:description\" content=\"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/\" \/>\n<meta property=\"og:site_name\" content=\"Threatcop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-09-04T17:32:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-14T10:00:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1250\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Threatcop\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatcop\" \/>\n<meta name=\"twitter:site\" content=\"@threatcop\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Threatcop\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/\"},\"author\":{\"name\":\"Threatcop\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/e4db27ffd37219d73fc6b40cc9d45cfa\"},\"headline\":\"Charming Kitten Made a Comeback Using WhatsApp and LinkedIn\",\"datePublished\":\"2020-09-04T17:32:59+00:00\",\"dateModified\":\"2024-08-14T10:00:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/\"},\"wordCount\":836,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp\",\"articleSection\":[\"Cyber Attacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/\",\"name\":\"Charming Kitten Resurfaces on WhatsApp and LinkedIn\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp\",\"datePublished\":\"2020-09-04T17:32:59+00:00\",\"dateModified\":\"2024-08-14T10:00:45+00:00\",\"description\":\"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#primaryimage\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/09\\\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp\",\"width\":1250,\"height\":1200,\"caption\":\"Charming Kitten Cyber Attacks\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Charming Kitten Made a Comeback Using WhatsApp and LinkedIn\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"name\":\"Threatcop\",\"description\":\"Cybersecurity Blogs, News, Updates, and Articles\",\"publisher\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#organization\",\"name\":\"Threatcop\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/threatcop-logo-black-1.png\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/threatcop-logo-black-1.png\",\"width\":432,\"height\":102,\"caption\":\"Threatcop\"},\"image\":{\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/people\\\/Threatcop\\\/100083109892339\\\/\",\"https:\\\/\\\/x.com\\\/threatcop\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/threatcop\\\/\",\"https:\\\/\\\/www.instagram.com\\\/threatcop_official\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/#\\\/schema\\\/person\\\/e4db27ffd37219d73fc6b40cc9d45cfa\",\"name\":\"Threatcop\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"url\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"contentUrl\":\"https:\\\/\\\/threatcop.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/avatar_user_1_1696398433.jpeg\",\"caption\":\"Threatcop\"},\"sameAs\":[\"https:\\\/\\\/threatcop.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Charming Kitten Resurfaces on WhatsApp and LinkedIn","description":"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/","og_locale":"en_US","og_type":"article","og_title":"Charming Kitten Resurfaces on WhatsApp and LinkedIn","og_description":"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.","og_url":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/","og_site_name":"Threatcop","article_publisher":"https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","article_published_time":"2020-09-04T17:32:59+00:00","article_modified_time":"2024-08-14T10:00:45+00:00","og_image":[{"width":1250,"height":1200,"url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp","type":"image\/webp"}],"author":"Threatcop","twitter_card":"summary_large_image","twitter_creator":"@threatcop","twitter_site":"@threatcop","twitter_misc":{"Written by":"Threatcop","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#article","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/"},"author":{"name":"Threatcop","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/e4db27ffd37219d73fc6b40cc9d45cfa"},"headline":"Charming Kitten Made a Comeback Using WhatsApp and LinkedIn","datePublished":"2020-09-04T17:32:59+00:00","dateModified":"2024-08-14T10:00:45+00:00","mainEntityOfPage":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/"},"wordCount":836,"commentCount":0,"publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"image":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp","articleSection":["Cyber Attacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/","url":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/","name":"Charming Kitten Resurfaces on WhatsApp and LinkedIn","isPartOf":{"@id":"https:\/\/threatcop.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#primaryimage"},"image":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#primaryimage"},"thumbnailUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp","datePublished":"2020-09-04T17:32:59+00:00","dateModified":"2024-08-14T10:00:45+00:00","description":"The infamous Charming Kitten, an Iran-linked APT, is back with more sophisticated phishing attacks via LinkedIn and WhatsApp.","breadcrumb":{"@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#primaryimage","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2020\/09\/Charming-Kitten-uses-WhatsApp-and-LinkedIn-for-Comeback.webp","width":1250,"height":1200,"caption":"Charming Kitten Cyber Attacks"},{"@type":"BreadcrumbList","@id":"https:\/\/threatcop.com\/blog\/charming-kitten-uses-whatsapp-and-linkedin-to-make-a-comeback\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/threatcop.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Charming Kitten Made a Comeback Using WhatsApp and LinkedIn"}]},{"@type":"WebSite","@id":"https:\/\/threatcop.com\/blog\/#website","url":"https:\/\/threatcop.com\/blog\/","name":"Threatcop","description":"Cybersecurity Blogs, News, Updates, and Articles","publisher":{"@id":"https:\/\/threatcop.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/threatcop.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/threatcop.com\/blog\/#organization","name":"Threatcop","url":"https:\/\/threatcop.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/08\/threatcop-logo-black-1.png","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2026\/08\/threatcop-logo-black-1.png","width":432,"height":102,"caption":"Threatcop"},"image":{"@id":"https:\/\/threatcop.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/people\/Threatcop\/100083109892339\/","https:\/\/x.com\/threatcop","https:\/\/www.linkedin.com\/company\/threatcop\/","https:\/\/www.instagram.com\/threatcop_official\/"]},{"@type":"Person","@id":"https:\/\/threatcop.com\/blog\/#\/schema\/person\/e4db27ffd37219d73fc6b40cc9d45cfa","name":"Threatcop","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","url":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","contentUrl":"https:\/\/threatcop.com\/blog\/wp-content\/uploads\/2023\/10\/avatar_user_1_1696398433.jpeg","caption":"Threatcop"},"sameAs":["https:\/\/threatcop.com"]}]}},"_links":{"self":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/657","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/comments?post=657"}],"version-history":[{"count":10,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/657\/revisions"}],"predecessor-version":[{"id":11811,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/posts\/657\/revisions\/11811"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media\/7461"}],"wp:attachment":[{"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/media?parent=657"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/categories?post=657"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threatcop.com\/blog\/wp-json\/wp\/v2\/tags?post=657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}