Iran-linked phishing clusters blur into a new credential theft actor

At a glance

What this is: Proofpoint describes a new phishing cluster, UNK_SmudgedSerpent, that blended conversation lures, credential theft pages, and RMM delivery while overlapping with Iranian tradecraft.

Why it matters: Identity teams need to treat social engineering, credential capture, and remote tooling as a single access path because the same campaign can move from lure to foothold without a clean boundary between email security and identity governance.

Context

Phishing campaigns that start as benign conversation can still become identity incidents when the goal is credential capture and post-compromise access. In this case, the underlying governance gap is not just message delivery but the trust placed in a thread, a sender persona, and a login page that looks familiar enough to solicit action.

Proofpoint’s analysis centers on UNK_SmudgedSerpent, a cluster it tracked between June and August 2025 while it targeted academics and foreign policy experts. The broader lesson for IAM and security teams is that identity deception can span email, web login flows, and remote tooling in one sequence, which means detection and governance have to follow the access path rather than the channel alone.

Key questions

Q: What breaks when a phishing thread itself becomes the trust signal?

A: The normal separation between message delivery and user verification breaks down. Once a target responds inside an established thread, later links and login prompts inherit credibility from the earlier conversation, which reduces scrutiny and increases the chance of credential capture or payload execution.

Q: Why do spoofed collaboration portals increase credential theft risk?

A: Spoofed collaboration portals exploit user habit. People expect Microsoft 365, Teams, and file-hosting workflows to look familiar, so attackers use the same visual language to lower hesitation, mask redirect chains, and capture credentials before the user notices the destination has changed.

Q: What are the signs that phishing has moved beyond email into remote access?

A: Watch for a progression from conversation-based lures to login pages, then to archive downloads, MSI execution, and first-seen RMM software. That sequence indicates the actor is trying to convert social engineering into live operator control rather than stopping at credential theft.

Q: How should security teams respond when RMM tools appear in a phishing chain?

A: Treat the appearance of RMM in a phishing chain as a governance escalation, not just malware. Restrict installation rights, monitor for new RMM binaries and sessions, and investigate whether the tool was used to bridge from initial lure to interactive access.

Technical breakdown

Benign conversation as an access vector

The campaign began with a socially engineered exchange rather than a spray-and-pray phishing blast. By keeping the initial contact plausible, using region-specific political themes and trusted personas, the actor reduced suspicion before introducing a credential request. This is a common phishing pattern, but the operational detail matters: the thread itself becomes part of the lure. Once a target engages, later links, file hosts, and login pages inherit that trust. For practitioners, the technical issue is not just email authentication. It is how much downstream confidence users assign to any request that emerges from an already-accepted conversation.

Practical implication: train users to treat an ongoing thread as untrusted until login destinations and file hosts are independently verified.

Credential harvesting pages that borrow trusted brands

The actor used spoofed OnlyOffice, Microsoft 365, and Microsoft Teams themes to move the target onto a credential harvesting page. In these cases, the page does more than imitate a brand. It pre-loads user information, removes friction, and narrows the chance that a target notices they are leaving the original context. That combination is effective because it turns identity verification into a familiar routine. From a control perspective, the weak point is not only the fake page. It is the user expectation that collaboration tools and sign-in pages are interchangeable signs of legitimacy.

Practical implication: pair user training with conditional access, domain reputation checks, and explicit login-origin verification.

RMM payloads extend the attack beyond initial compromise

After credential theft attempts and decoy content, the actor delivered an MSI that launched PDQConnect and later used ISL Online in suspected hands-on-keyboard activity. RMM tooling is legitimate software, which makes it attractive for abuse because it can look like ordinary administration after execution. The key technical issue is that the attack shifts from persuasion to remote control once the payload is run. That matters for identity governance because the foothold no longer depends on a spoofed login alone. It can evolve into live operator access, using tools that may already exist in many environments for support and administration.

Practical implication: tightly govern RMM installation, alert on new RMM binaries, and separate support tooling from user-exposed endpoints.

Threat narrative

Attacker objective: The objective was to steal credentials and establish remote access that could support intelligence collection and continued interaction with targeted victims.

1. Entry began with benign email conversation and persona-based lures that targeted specific academics and policy experts.
2. Credential harvesting followed when the actor redirected targets to spoofed Microsoft and OnlyOffice login pages designed to capture credentials.
3. Escalation continued through an MSI that launched PDQConnect, after which the actor used RMM tooling for suspected hands-on-keyboard activity.
4. Impact was the creation of an operator-controlled access path that could support follow-on espionage, collection, or persistence without relying on the original lure.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Thread-based trust is now an identity control problem: The campaign worked because the trust boundary moved from the inbox to the conversation. Once a target engages in-thread, later login prompts and file-hosting links inherit legitimacy from the prior exchange. That breaks the assumption that users can reliably re-evaluate risk at each step, which means identity governance has to account for social context, not just authentication events.

Credential capture and remote tooling are the same access path in practice: This actor did not need a clean separation between phishing and post-exploitation. It used a login lure to pursue credentials, then shifted to RMM payloads to create a more durable operator channel. The implication is that practitioners should stop treating mailbox compromise, web credential theft, and RMM abuse as separate problems when the access chain is clearly continuous.

Trusted collaboration software is becoming a disguise layer for hostile identity flows: OnlyOffice, Microsoft 365, and Teams branding were used to make the interaction feel ordinary. That is not just brand impersonation; it is workflow impersonation, where the attacker borrows the expected shape of collaboration to lower user resistance. The field needs to recognize that identity deception increasingly wraps itself around legitimate work patterns rather than standing apart from them.

Iran-linked tradecraft is converging on flexible, mixed-tool access operations: Proofpoint’s clustering shows overlap with TA453, TA455, and TA450 style tactics without clean attribution to any single actor. That ambiguity matters because practitioners cannot rely on a single-group signature to drive defense. The right response is to harden against the access pattern itself, not the label attached to the campaign.

Remote management abuse expands the identity blast radius: When an attacker shifts from lure to RMM, the control problem broadens from email hygiene to endpoint administration and operator privilege. The environment now has to distinguish legitimate support use from hostile hands-on-keyboard activity. Practitioners should treat RMM enablement, approval, and monitoring as part of identity governance, not only endpoint operations.

What this signals

Conversation-first phishing will keep defeating controls that only watch for malicious attachments: Campaigns like this show that the real boundary is not the email gateway but the moment a user accepts the conversation as legitimate. Teams need detections and user guidance that follow the sequence from thread to redirect to credential page, because that is where the attacker actually wins.

Remote management tools are now part of the identity attack surface: When an attacker can pivot from a lure into an RMM session, the incident is no longer only about email compromise. It becomes an access-governance problem that spans endpoint control, approval boundaries, and operator monitoring.

For practitioners

• Tighten thread-following behavior controls Teach users to verify any unexpected login prompt or file link outside the original thread context, even when the sender persona seems established. Use this campaign type to reinforce that conversation continuity is not proof of legitimacy.
• Harden identity verification on collaboration lures Review how your environment handles Microsoft 365, Teams, and file-hosting lookalikes, including domains, sign-in redirects, and pre-filled credential pages. Block or challenge login destinations that arrive through untrusted hosted content.
• Restrict and monitor RMM installation paths Limit which endpoints can install PDQConnect, ISL Online, and similar tools, then alert on first-seen RMM binaries, MSI execution from web-delivered archives, and unexpected operator sessions.
• Correlate email, web, and endpoint telemetry Build detections that follow the sequence from suspicious email to redirected login page to MSI execution and RMM process launch. That correlation is what exposes the full attack path when each individual step may look low severity.
• Use topic-based targeting as an early warning signal Watch for politically themed conversation starters that target a narrow professional community, because the targeting model itself can reveal campaign intent before payload delivery begins.

Key takeaways

• UNK_SmudgedSerpent shows how social engineering can move from conversation to credential capture to remote access without a clear break between stages.
• The campaign used spoofed collaboration pages, credential harvesting infrastructure, and RMM payloads, which makes the access path more durable than a single phishing click.
• Defenses need to correlate email, identity, and endpoint telemetry, because the most important signal is the full sequence, not any one lure or binary.

Key terms

• Benign Conversation Starter: A social-engineering opening that appears low risk and contextually relevant so the target is more likely to engage. In phishing operations, it is used to earn trust before any malicious link, credential prompt, or attachment is introduced.
• Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
• Remote management tool: A remote management tool is software used to administer endpoints, servers, or customer environments from a central console. These tools are high-value targets because compromise can provide broad control over many systems, which makes their authentication, patching, and monitoring especially important.
• Conversation Thread Hijacking: A tactic where an attacker uses an ongoing exchange to extend trust and steer the victim toward malicious actions. The message history becomes part of the deception, which makes later requests harder to evaluate than a standalone phishing email.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.