Proofpoint Says TA453 Used Iran Conflict as a Phishing Lure for Espionage

Summary

Proofpoint reported that Iran-aligned TA453 targeted a U.S. think tank with a credential-phishing attempt, using rapport-building emails, a malicious PDF link and a OneDrive-themed login page. The correspondence began before the conflict escalated.

Key points

Proofpoint reported increased state-aligned cyber operations associated with the February 2026 Operation Epic Fury conflict.
On March 8, researchers observed TA453 targeting a U.S. think tank; the initial correspondence began before the conflict escalated.
The campaign used benign emails to build rapport, followed by a malicious link disguised as a PDF.
The link redirected to a OneDrive-themed credential-phishing page pre-filled with the target’s email address.
Proofpoint assessed that the activity likely sought intelligence on the conflict’s trajectory and broader geopolitical implications.
The article says campaigns targeting Middle Eastern government and diplomatic entities increased, and that TA453 remained operational despite an internet shutdown.

Article Details

Event Type: Credential-phishing and cyber-espionage activity exploiting the Operation Epic Fury conflict as a social-engineering pretext and intelligence-collection driver.
Impact: Proofpoint reported increased cyber operations tied to the conflict. TA453 targeted a U.S. think tank with a credential-phishing attempt and sought geopolitical intelligence; researchers also observed increased campaigns targeting Middle Eastern government and diplomatic entities. The reported lure used rapport-building emails, a malicious PDF link, and a OneDrive-themed credential page.