Charming Kitten 2025: Strategic Target Selection and Researcher Surveillance Analysis

Overview

This research examines a new Charming Kitten campaign utilizing advanced impersonation tactics, long-term monitoring of security researchers, and unique infrastructure. This analysis is based on new evidence and exclusive IoCs not published in public reports.

Executive Summary

The Charming Kitten group has launched a campaign impersonating Ariane Tabatabai - a Pentagon official who was investigated by Congress last year for her membership in the Iran Experts Initiative and after controversies was reassigned from Special Operations to Force Education in October 2024, a position that ended in January 2025 - to target Iranian activists.

What makes this campaign unique:

• Strategic Impersonation: Choosing an official already under controversy shows deep understanding of U.S. politics
• Long-term Planning: Started monitoring my channel at least 2 months before operations
• Researcher Surveillance: They know when their infrastructure gets exposed
• Unprecedented Scale: Over 30 active domains not in public IoCs

Key Evolutions from Previous Campaigns:

1. Strategic Target Selection: Impersonating real officials with existing controversies
2. Active Monitoring: Watching my channel to identify exposure timing
3. Long-term Planning: At least 2 months of preparation before active operations
4. Infrastructure Automation: Clear book.* and viliam.* patterns indicate automation
5. Scale: Over 30 active domains in two months
6. Technical Evolution: Use of WebSocket (though recently exposed by Check Point Research)

Technical Analysis

Attackers first contact victims through Telegram. The profile is created using Ariane Tabatabai's real photo and information:

Fake Account Details:

• Name: Arian Tabatabai
• Phone number: UK
• Registration date: May 2025
• Joined my public channel: May 19, 2025 at 15:18
• Last activity: Updated photo and name on July 27

Important note: The account was created in May 2025 but remained inactive until late July. This shows attackers prepared their infrastructure in advance and activated it at the appropriate time.

Evidence Note: Screenshots from my public channel subscriber list show this account joined on May 19. This pattern has been observed before - attackers monitor my channel and when their servers are exposed, they shut them down.

Initial messages typically include:

• Invitations to "important" meetings about regional security
• References to "new developments" in US policy
• Requests for "consultation" on Iran issues

Infrastructure Details

WebSocket Implementation

The group uses WebSocket for real-time monitoring - a technique recently documented by Check Point Research.

// Connection establishment
wss://jessyland[.]online:8569/room

// Real-time data exfiltration

• Every keystroke
• Form field changes

POST Request Analysis

Phishing Kit Features

Google Account Recovery Simulation

The phishing page precisely mimics Google's authentication flow:

1. Displays victim's email
2. Requests confirmation from another device ("Check your Galaxy S23+")
3. Shows confirmation code (e.g., 52)
4. Creates urgency with timer

Indicators of Compromise

Infrastructure Patterns

The attackers use specific patterns in domain registration:

• Subdomain pattern: book[.][domain][.]online
• Subdomain pattern: viliam[.][domain][.]online
• All domains registered in July-August 2025 timeframe
• Use of UUIDs in some subdomains (e.g., arcanet[.]online)

Timeline Analysis

Domain registration dates and activities reveal an interesting pattern:

• May 2025: Registration of fake Arian Tabatabai Telegram account
• May 19, 2025: Fake account joins my public channel (likely for monitoring)
• June 2025: Registration of amjc-jp[.]com subdomains (likely initial infrastructure)
• July 19-20: Start of [.]online domain registrations (samoli, arcanet, cppsg, tomsahor)
• July 26-30: Increased registration pace (alpha-meet, alpha-radial, jessyland, online-speak)
• July 27: Activation of Telegram account (updated photo and name)
• August 3-5: New wave of registrations (5 domains on August 5 alone)

This pattern indicates:

1. Preparation started in May (creating social media accounts and monitoring my channel)
2. Infrastructure building in June-July
3. Active operations from late July
4. Peak activity in August

Important note: Joining my channel shows attackers monitor exposure activities - a pattern I've observed in the past.

Attribution

This campaign is attributed with high confidence to Charming Kitten (APT35/Phosphorus/Newscaster) based on:

• Use of similar social engineering techniques
• Targeting of Iranian activists and journalists
• Infrastructure patterns similar to previous campaigns
• Use of Google Sites as intermediary stage (TTP observed in previous operations)
• Timing with Iran-related political developments

Conclusion

This campaign demonstrates Charming Kitten's evolution from a simple phishing group to a threat actor with deep geopolitical understanding. Choosing Ariane Tabatabai - herself the subject of security controversies - for impersonation shows this group:

1. Closely tracks U.S. political developments - they know who has controversies
2. Monitors security researchers - watched my channel since May
3. Has long-term planning - waited 2 months for infrastructure readiness
4. Unprecedented operational scale - 30+ domains not in public IoCs