Loading story…
Iran-linked threat activity tracked as Cobalt Dickens and Silent Librarian continued targeting universities with large-scale credential-phishing campaigns designed to steal access to library systems, email, and research resources. Security researchers linked the activity to tactics associated with the Mabna Institute operators charged by the U.S. in 2018, noting that the campaign persisted despite those indictments. In one wave, attackers used 16 domains hosting more than 300 spoofed login pages impersonating 76 universities in 14 countries, including institutions in the United States, Canada, the United Kingdom, and Japan, to harvest usernames and passwords and facilitate theft of intellectual property.
Later reporting showed the university-focused phishing remained active and evolved in delivery and infrastructure. Investigators documented renewed Silent Librarian operations using recently registered domains, phishing subdomains, and IP infrastructure that mimicked legitimate academic portals, while separate campaigns in 2021 used COVID-19, Delta, and Omicron lures, malicious URLs, HTM attachments, fake Office 365 and university login pages, and in some cases spoofed Duo prompts to capture MFA credentials. Researchers also observed compromised university email accounts being reused to send additional phishing messages, underscoring a sustained effort to exploit academic institutions for credential theft, network access, and potential research and intellectual-property collection.
Get the infrastructure and lures behind it.
10 events from the most recent confirmed update back to the earliest known activity.
After the Omicron variant was announced in late November 2021, threat actors shifted from Delta-themed lures to Omicron-themed phishing messages targeting university users and harvesting credentials.
Proofpoint said it observed consistent credential-phishing campaigns against primarily North American universities beginning in October 2021, with thousands of messages sent to dozens of schools.
WHOIS data showed phishing domains tied to Silent Librarian were registered between August 14 and October 2, 2020, largely through NameCheap and privacy services.
Secureworks said the most recent domain used in the ongoing university credential-theft campaign was registered on August 19, 2018.
Secureworks reported that domains used in a new Cobalt Dickens university phishing campaign were registered between May and August 2018, indicating the group remained active after the March indictment.
On March 23, 2018, the United States indicted nine Iranian nationals allegedly tied to the Mabna Institute for hacking universities, government agencies, and businesses. U.S. authorities said the operation stole intellectual property and was conducted in support of the IRGC.
The U.S. Department of Justice said the Mabna Institute had conducted a coordinated cyber intrusion campaign since at least 2013, targeting universities, companies, and other organizations for intellectual property theft.
Malwarebytes identified 25 phishing subdomains and three IP addresses targeting 21 academic institutions worldwide, and additional analysis found 11 more suspicious subdomains and two more IPs.
CircleID reported that Silent Librarian was detected again as the academic year began in September, targeting universities and colleges to steal research data and intellectual property.
Secureworks disclosed an ongoing campaign using 16 domains and roughly 300 spoofed login pages impersonating 76 universities across 14 countries to steal credentials. The company linked the activity to Cobalt Dickens and assessed ties to earlier Iranian operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourcecircleid.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Aug 11, 2026
Threat actors have launched a sophisticated phishing campaign targeting U.S. universities by leveraging the open-source Evilginx framework. At least 18 educational institutions have been affected since April 2025, with attackers using personalized emails containing TinyURL links that redirect to dynamically generated phishing pages. These pages closely mimic student single sign-on portals and employ advanced evasion techniques, such as expiring URLs, wildcard TLS certificates, bot filtering, and JavaScript obfuscation, making detection and mitigation increasingly difficult. The campaign demonstrates the growing accessibility of advanced phishing tools, enabling even unskilled actors to bypass multi-factor authentication and compromise sensitive credentials. Simultaneously, a new phishing kit called Spiderman has emerged on the dark web, targeting customers of major European banks and cryptocurrency platforms. This full-stack kit allows attackers to easily clone login pages for dozens of financial institutions and conduct real-time credential theft across multiple countries. With a large user community and features that facilitate immediate data exfiltration and hybrid fraud operations, Spiderman represents a significant escalation in the scale and efficiency of phishing threats facing the financial sector. Both campaigns highlight the evolving landscape of phishing, where sophisticated toolkits are lowering the barrier to entry for cybercriminals and increasing the risk to organizations worldwide.
Jun 29, 2026
Multiple reports describe a broader **credential-theft trend** in which attackers abuse trusted services and familiar business workflows to make phishing more convincing and harder to detect. One campaign used **compromised WordPress sites** and redirects through `skimresources[.]com` to deliver pixel-perfect fake login pages for **Microsoft Teams**, **Xfinity**, and **UAE Pass**, with lures such as missed voicemail and shared-document alerts. Another campaign abused **LiveChat**'s `lc[.]chat` infrastructure to impersonate brands like **PayPal** and **Amazon**, moving victims into fake support conversations designed to extract sensitive information under the guise of refunds or order issues. A separate industry report reinforces the same operational pattern: attackers increasingly rely on **valid credentials** and trusted collaboration tools rather than software exploits, with cloud identity compromise driving most investigated incidents and some intrusions using **Microsoft Teams voice phishing** and **Quick Assist** to gain access, move laterally, and deploy ransomware. Other references in the set cover different stories entirely, including the **CamelClone** espionage operation, a **FancyBear/APT28** infrastructure exposure, and a general weekly security recap, and do not describe the same phishing activity. This is **not fluff** because the relevant items contain substantive threat intelligence on active attack methods, delivery infrastructure, and attacker tradecraft.
Jun 29, 2026