Iranian MuddyWater Hackers Use Compromised Mailboxes for Global Phishing Scams

• Group-IB links macro-phishing campaign to Iranian actor MuddyWater
• Attackers used fake emails and Word documents to deploy Phoenix v4 and other malware.
• Despite macros being blocked since 2022, outdated techniques are still used in the wild

It’s October 2025, and yet some cybercriminals are still trying to distribute malware via Microsoft Word macros, experts have warned.

Recently, security researchers at Group-IB discovered a new cyberespionage campaign that begins with compromised email accounts, which malicious actors were using to distribute phishing emails. These messages targeted international organizations in different regions around the world, imitating authentic correspondence to increase the chances that victims would actually open the emails.