Researchers linked the Iran-aligned Handala Hack persona to a Telegram-controlled backdoor (HEAVYGRAM) that can steal passwords and exfiltrate chat data. The campaign reportedly starts with social engineering on messaging apps (Telegram, WhatsApp, Instagram), where the attacker pretends to offer technical support or acts like a trusted contact, then convinces the victim to install a trojanized “legitimate” app.
The campaign linked to the Handala Hack persona begins not with an email but with a direct message. Attackers reach out through Telegram, WhatsApp, or Instagram, presenting themselves as technical support or as a trusted contact. Once a rapport is established, the conversation shifts toward a request: install an update or installer to fix a supposed problem. The file handed over is not what it claims to be. It masquerades as a legitimate application such as Pictory, KeePass, or Telegram, but actually contains a second-stage implant called HEAVYGRAM.
HEAVYGRAM is notable for using Telegram itself as its command-and-control channel. Once active, it can steal saved passwords, capture screenshots, and copy data from Telegram and WhatsApp, giving the operator ongoing visibility into a victim's communications and credentials.
This approach works because it exploits trust built through familiar, everyday channels rather than a suspicious email attachment. A message from what appears to be a known contact or a helpful support agent lowers a target's guard. Researchers describe the operation as a multi-stage infection chain that combines tailored social engineering, application masquerading, and persistence, meaning the deception does not rely on a single trick but on layering several convincing elements together.
Organizations, especially those supporting journalists, NGO staff, and executives who rely heavily on messaging apps, should reinforce a simple rule: software and updates should only come from official vendor sites or app stores, never from a direct message. Staff should be encouraged to treat unsolicited tech support outreach as suspicious by default, even when it appears to come from someone they recognize. High-risk teams covering sensitive topics or operating in adversarial environments may benefit from additional, focused training on messaging-app lures and application masquerading, since these groups have been specifically named as targets of this type of campaign. Building a habit of pausing before installing anything sent through chat, and verifying requests through a separate channel, can blunt the effectiveness of this kind of layered social engineering.
This technique maps to MITM-relevant behaviors such as Phishing via Service and User Execution: Malicious File, both of which rely on convincing a person to take an action rather than exploiting a technical flaw.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It begins with social engineering on messaging apps like Telegram, WhatsApp, and Instagram, where the attacker poses as tech support or a trusted contact to build rapport with the target.
Victims are convinced to install a trojanized app disguised as legitimate software such as Pictory, KeePass, or Telegram, which contains a second-stage implant known as HEAVYGRAM.
HEAVYGRAM uses Telegram for command-and-control and can steal saved passwords, capture screenshots, and copy Telegram and WhatsApp data.
Reported targets include journalists, NGO and activist staff, executive leadership, and other individuals who rely on Telegram, WhatsApp, or Instagram for work.
Imagine this Telegram DM: "Hi, I can help with your KeePass issue. Install this update so I can fix it." Looks helpful, right? Researchers tied this to Handala using a backdoor called HEAVYGRAM. They chat you up on Telegram, WhatsApp, or Instagram, then send a trojan installer pretending to be Pictory, KeePass, or even Telegram itself. Here’s the nasty part: once you run it, HEAVYGRAM quietly talks back over Telegram, can steal saved passwords, grab screenshots, and copy your Telegram and WhatsApp chats. If anyone DMs you tech support and sends an installer, don’t run it, go to the official app store or vendor site yourself and download only from there.
UK, US, and Dutch agencies warned that Iranian state-linked actors used social messaging apps to build trust with dissidents, journalists, and activists before sending disguised files that install Windows malware. The attackers often impersonated someone the target already knows or “technical…
A joint UK-US-Dutch advisory warns Iranian state-backed cyber actors are targeting dissidents, activists, and journalists by first contacting them on WhatsApp or Telegram and building trust. The attackers then persuade victims to open a malicious file disguised as legitimate software (or even MRI…
UK and allied agencies warn that a Tehran-backed operation is targeting dissidents, activists, and journalists using social engineering to trick them into installing spyware called “Chosen Brick.” Attackers build trust on social media by impersonating known contacts or “technical support,” then…
Government agencies say Iranian intelligence-linked attackers are targeting dissidents, journalists, and activists with Windows malware controlled through Telegram. The attack starts with a trust-building message impersonating someone the victim knows or app support, then delivers a file disguised…
UK, US and Dutch authorities warned that Iran-linked attackers are targeting dissidents, activists, and journalists with Windows spyware. The group builds trust over messaging apps, then tricks victims into downloading malware disguised as legitimate software (or even medical files). The spyware…
UK, US, and Dutch agencies warned that Iran-linked operators used long-running social engineering to build trust with targets (including dissidents, activists, and journalists), then sent malicious files disguised as legitimate documents or software installers. One lure included a fake MRI scan…
