Iranian Hackers Launch Targeted Cyber Espionage by Mimicking German Modeling Firm
In an alarming development in cyber espionage tactics, Iranian-linked operatives have engineered a counterfeit website that mimics a prominent German modeling agency. Their objective: harvesting intelligence on carefully selected individuals, with a likely focus on members of Iranian opposition circles.
Uncovered in early May 2025, the campaign leverages highly selective tracking scripts to build profiles of site visitors. These scripts, embedded within a visually authentic replica of Hamburg’s Mega Model Agency website, silently collect technical data such as IP addresses, browser fingerprints, screen sizes, and system configurations.
Rather than broadcasting malware broadly, the attackers use this surveillance layer to filter for high-value targets, suggesting a level of sophistication typical of advanced persistent threat (APT) operations.
Cybersecurity experts at Palo Alto Networks link this operation to a state-backed Iranian cyber unit—believed to be Agent Serpens (also known as APT35 or Charming Kitten). This group is notorious for pursuing Iranian expatriates, journalists, and human rights advocates, especially those residing in Germany.
Adding another layer of deception, the fake site includes a fabricated model persona, “Shir Benzion,” to lure visitors into engaging further, underscoring the evolution of psychological manipulation in cyber operations.
This operation exemplifies how cyber adversaries are blurring the lines between online identity fraud and espionage to undermine political dissent beyond their borders.
Cloned Model Profile Used as Espionage Bait on Spoofed Talent Agency Website
In a bold escalation of digital deception, a fake modeling agency website—crafted to mirror Germany’s Mega Model Agency—has been found featuring a fabricated persona named “Shir Benzion.” This fictitious model profile, inserted in place of a real one, includes a suspicious but currently dormant link labeled “private album,” a potential staging point for future phishing lures or malware deployment.
Unlike ordinary scams, this operation exhibits high levels of technical concealment. At its core is a stealthy JavaScript payload—hidden within the cloned site’s codebase—that operates as a silent reconnaissance tool.
Security analysts dissecting the script found that it runs multiple reconnaissance tasks in parallel. The script quietly maps the visitor’s software environment by capturing browser language settings, installed plugins, and screen dimensions. It then pushes further, using WebRTC capabilities to expose both local and external IP addresses—granting the attackers network-level visibility into the user’s system.
Taking fingerprinting to the next level, the code deploys a canvas-based device ID method. By rendering and hashing a canvas element, it produces a unique SHA-256 signature for each device:
javascript
function fingerprintDevice() {
const canvas = document.createElement(‘canvas’);
const ctx = canvas.getContext(‘2d’);
ctx.font = “14px Arial”;
ctx.fillText(“DeviceID”, 2, 2);
return sha256(canvas.toDataURL());
}
The exfiltrated data is formatted in JSON and exfiltrated to a disguised endpoint masquerading as an advertising tracker (/ads/track). This clever use of misdirection allows the attackers to blend their activity into regular analytics traffic, bypassing many conventional security filters.
This carefully engineered infrastructure highlights the adversary’s evolving tactics—combining convincing visual forgeries with advanced web-based surveillance to quietly assemble dossiers on individuals who may be targeted in future operations.
