Iranian hackers attempted to steal user details by pretending to be a German modelling agency, as reported by Palo Alto Networks’ Unit 42.
The malicious website spoofed a legitimate modelling agency website, using obfuscated JavaScript to capture visitor information like browser details and IP addresses.
The goal of the attack was likely selective targeting based on device and network-specific data collected from visitors.
Unit 42 speculates that the Iranian threat actors involved could be associated with groups like Agent Serpens or APT35 for potential future attacks involving malware or credential theft.