Loading malware…
HYPERSCRAPE is a custom data-extraction malware tool associated with the Iranian threat actor APT35, also tracked as Charming Kitten, COBALT ILLUSION, APT42, and Phosphorous. It is designed to access and silently collect data from webmail accounts, with reporting specifically linking it to theft from Gmail, Yahoo, and Microsoft email accounts. The malware has been described as logging into victim accounts and exfiltrating email data in bulk, supporting post-compromise collection operations after credentials have been obtained through the actor’s broader phishing and social-engineering campaigns.
Operational reporting ties HYPERSCRAPE to espionage activity targeting individuals and organizations of intelligence interest to Iranian state-linked operators, including researchers, journalists, activists, diplomats, human rights defenders, and others focused on Middle Eastern and Iran-related issues. The tool fits APT35’s established pattern of credential theft followed by large-scale mailbox and account-data collection. In some cases, similar post-compromise collection by the same actor has also involved cloud-provider export features, indicating a broader emphasis on bulk extraction from online accounts.
HYPERSCRAPE was designed to run locally while still requiring command-and-control interaction before proceeding, indicating operator-controlled execution gating. Its role is best characterized as an account-focused collection utility used in post-compromise espionage rather than an initial-access implant. The malware targets Windows systems used to access victim webmail and supports exfiltration of data from major email service providers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In December 2021, the Google Threat Analysis Group (TAG) reported on COBALT ILLUSION's use of the custom HYPERSCRAPE (also known as EmailDownloader) tool to steal user data from Gmail, Yahoo, and Microsoft accounts.
On August 23, Google’s Threat Analysis Group (TAG) released a blog about a new data extraction tool used by an Iranian APT. While the tool was designed to be run locally, it still needed to receive a response from one of two Command and Control (C2) servers before proceeding... Google does not discuss the apparent use of hijacked subdomains ... in its recent report on the HYPERSCRAPE tool it attributed to APT35/Charming Kitten.
The use of Google Takeout to extract data from a compromised account is in line with the features of the HYPERSCRAPE tool identified by the Google TAG team, although Human Rights Watch could not confirm if the tool was used based on logs to which it had access.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Hyperscrape, used to quietly extract emails from Yahoo!, Google, and Microsoft Outlook mailboxes once valid credentials or session cookies are obtained.
APT35 developed a tool called Hyperscrape designed to log in and silently exfiltrate emails from victim Gmail and Microsoft accounts.
In at least one case, the attacker synced the target’s mailbox and performed a Google Takeout, a service that exports all of an account’s activity and information including web searches, payments, travel and locations, ads clicked on, YouTube activity, and additional account information.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A data extraction tool attributed in the referenced reporting to APT35/Charming Kitten. It runs locally but requires a response from one of two C2 servers before proceeding.
A custom tool used by COBALT ILLUSION to steal user data from Gmail, Yahoo, and Microsoft accounts after account compromise.
A custom APT35 tool used to authenticate to victim Gmail/Microsoft accounts and silently exfiltrate email data.
A data-exfiltration tool used to log into victim Gmail and Microsoft accounts and silently steal emails.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.