Persian Stalker is targeting Iranian social media accounts.
The “group” has been around since 2017, and they have been observed targeting social media accounts. Specifically, this group focuses on gaining access and control of Instagram and Telegram accounts.
Telegram is a popular service with about 40 million users. Telegram is a communication app that has been used to organize protesters in Iran. Of course, the Iranian government is not a fan of this service. The Iranian government has actively requested that certain services and channels be shut down. As far as we know, the Iranian government has not engaged in blocking the service in Iran.
Persian Stalker uses several techniques to gain access to user’s accounts. They have created false login pages for miss-typed domain names. If you accidentally misspell the website, the malicious website will appear that looks exactly like the real thing. When the user logs in the login data are captured, and the user is presented with an error message. Of course, the 2nd login will work correctly, so the user never finds out that their login information was compromised.
Reading an older article? Use the brief to stay current.
This Article Gives You the Background. The Brief Gives You What Changed Next.
Get the weekday cyber brief for new policy moves, CISA actions, and risk developments this article could not cover when it was published.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Another technique that Persian Stalker uses is BGP hijacking. BGP stands for Border Gateway Protocol. BGP is the routing protocol that is used in the internet backbone. BGP is also gaining popularity as the protocol used in some wide area networks. BGP hijacking is accomplished when the routing tables are corrupted so that the attacker can maliciously reroute internet traffic. In the case of Persian Stalker, the BGP hijacking is used to capture the user’s credentials.
In summary, Persian Stalker is a malicious team who is stealing social media account usernames and passwords. They are primarily targeting Iranian users, but this target may expand to other areas of the world. This group uses the stolen information for malicious purposes. There is no evidence that this group has any political agenda.
Reading an older article? Use the brief to stay current.
This Article Gives You the Background. The Brief Gives You What Changed Next.
Get the weekday cyber brief for the developments, risk shifts, and new signals that changed the picture after this article was published.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
CMMC After the Phase 2 Suspension: What Contractors Still Have to Do in 2026
Short answer: on July 13, 2026, the Department of War suspended the move to CMMC Phase 2, which was due on November...
Blue Team Certifications (2026): CySA+, GCIA, BTL1 and SC-200 Compared
Blue team certifications compared from the issuers' own pages: CompTIA CySA+ V4, GIAC GCIA, BTL1 from Centri (Security Blue Team) and Microsoft...
Digital Forensics Certifications (2026): GCFA, CHFI, EnCE and CCE Compared
Digital forensics certifications compared from the issuers' own pages: GIAC GCFA and GCFE, EC-Council CHFI, OpenText EnCE and ISFCE CCE, with exam...
Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
