Phishing Links Target Iranian Protesters: How Attackers Exploited WhatsApp to Steal Sensitive Data

A phishing attack exploiting WhatsApp to steal credentials and spy on Iranian protesters left a server exposed, revealing 850 victims—including a Lebanese minister and U.S. academics—highlighting the blurred line between state surveillance and cybercrime.

Nariman Gharib, a U.K.-based Iranian activist, received a phishing link via WhatsApp targeting Iran-related protesters.

The phishing page code and confirmed it aimed to steal Gmail credentials, WhatsApp accounts, and device media (location, audio, photos).

Over 850 victim records were exposed on the attacker’s server, including academics, a senior Lebanese minister, and a U.S. academic.

The campaign used DuckDNS for obfuscation and `alex-fabow.online` as the phishing domain.

Security researcher Runa Sandvik confirmed the page exploited browser APIs for location tracking and media access. Sandvik said:

"This drives home the point that clicking on unsolicited WhatsApp links... is a high-risk, unsafe practice."

Gary Miller linked the attack to Iran’s Islamic Revolutionary Guard Corps (IRGC) due to its espionage-like targeting and techniques.

The exposed server data underscores how cybercriminals and state actors increasingly converge in exploiting social media platforms for surveillance and credential theft.