A spear-phishing campaign by the Iranian-backed group Educated Manticore is targeting Israeli cybersecurity experts and university professors.

The attacks began in mid-June 2025 and exploit the ongoing Iran-Israel tensions to add urgency to their fake requests.

Hackers impersonate employees of top cybersecurity firms using convincingly professional emails and WhatsApp messages.

These bogus communications lure targets into giving cybersecurity advice for fake energy companies, a ruse that exploits trust and relevance.

The group uses AI-generated messages that are grammatically flawless and eerily formal to avoid raising suspicion.

Check Point researchers report this campaign is a major escalation in Educated Manticore’s technical prowess and strategic targeting.

Victims are funneled to spoofed Google Meet links and phishing pages designed to snatch both passwords and 2FA codes.

The malicious sites, hosted on Google Sites, mimic real authentication pages using slick React-based single-page apps.

The phishing infrastructure includes persistent WebSocket connections that transmit every keystroke in real time—even if the victim doesn’t hit “submit.”

Over 130 domains registered via NameCheap support this fast-moving scam, giving attackers the ability to swap domains quickly when flagged.

This campaign combines polished tech, psychological manipulation, and relentless infrastructure agility, marking a dangerous evolution in cyber warfare.