Iranian MuddyWater hackers use compromised mailboxes for global phishing scams

• Group-IB links a macro-based phishing campaign to Iranian threat actor MuddyWater
• Attackers used fake emails and Word documents to deploy Phoenix v4 and other malware
• Despite macro blocking since 2022, outdated techniques are still being used in the wild

It’s October 2025, but some cybercriminals are still trying to deliver malware via Microsoft Word macros, experts have warned.

Recently, security researchers Group-IB discovered a new cyberespionage campaign, which begins with compromised email accounts that the threat actors used to distribute phishing emails. These messages targeted international organizations in different regions of the world and mimicked authentic correspondence to increase the chances that victims would actually open the emails.