State-backed Iranian hackers used fake VPN apps to deploy spyware against Persian speakers worldwide, researchers report

Researchers report that state-backed Iranian hackers used fake VPN applications to deliver spyware targeting Persian speakers globally. The scheme relies on impersonation—creating apps that appear to offer privacy protection while secretly collecting device and communications data. Victims were exposed after downloading the malicious software, which researchers say could capture call logs, messages, contacts, and location information. The findings highlight how Iranian-linked intrusion methods continue to evolve beyond phishing into mobile and app-distribution channels. Researchers urge users and app stores to scrutinize VPN apps and apply security warnings promptly.