TA453__2021__BadBlood_TA453_Targets_US_and_Israeli_Medical_Research_Personnel_in_Credential_Phishing_Campaigns_Proofpoint_US.pdf

Proofpoint describes the BadBlood campaign by the Iranian-nexus TA453 threat actor targeting senior medical researchers in the US and Israel with credential phishing via actor-controlled domains and fake Microsoft login pages; successful harvesting of credentials could enable account compromise and potential inbox exfiltration, with references to related infrastructure and attribution suggesting IRGC-aligned operations and evolving targeting toward the medical sector.