On the heels of Iran driving a disinformation campaign on Facebook, researchers have discovered a spoofed university login page that appears to be part of a larger credentials theft campaign believed to be the work of COBALT DICKENS, a threat group associate with the Iranian government. According to the Counter Threat Unit (CTU) research team at Secureworks, 16 domains contained more than 300 spoofed websites and 76 university login pages across 14 countries, including Australia, Canada, China, Israel, Japan, Switzerland, Turkey, the United Kingdom, and the United States.

Read full news article on Infosecurity