Researchers detail a phishing campaign by Iran-linked hackers targeting US government officials that bypassed SMS-based 2FA protections in Gmail and Yahoo Mail
eg so you don't have to use the key every time you log on from the same computer at a known IP address. But if anything's unusual you do. Sensible thread http://twitter.com/... Elad Strohmayer / @eladstr : An impressive (yet not surprising) @AP exposé: an #Iranian hacking group targeted #US Treasury officials, high-profile defenders, detractors & enforcers of the #IranDeal, Arab atomic scientists, Iranian civil society figures & DC think tank employees. http://www.apnews.com/... Jake Williams / @malwarejake : Going after private email is an extremely effective tactic. The last two US administrations have had officials running private email servers. From the Clinton email server investigation, we know classified data ended up on the server. I'd bet Gmail has terabytes of classified 1/n http://twitter.com/... Zeynep Tufekci / @zeynep : People: get a security key for your Gmail, Facebook, Insta, Github—whatever you want to protect. *Especially* if you are a high-level target. Regular 2FA, including authenticator, can be phished. SMS can be redirected. (Security key how-to on next tweet). http://arstechnica.com/... http://twitter.com/...
Context & Ripple Effects
This campaign sits at the intersection of two threads in the coverage: state-linked operators going after officials' personal email, and the growing fragility of SMS-based authentication. The AP-sourced reporting describes Iranian hackers targeting Treasury officials, Iran Deal defenders and detractors, Arab atomic scientists, and DC think tank staff through Gmail and Yahoo Mail — consumer inboxes, not government systems.
The technique was not exotic: phish the one-time code, not the password. A year later, a report on the hack-for-hire market put a price tag on exactly this capability — $100-$400 per 2FA-phishing attack — showing what began as nation-state tradecraft had become a commodity service.
First-order effects
- US government officials and policy figures who relied on SMS codes to protect personal Gmail or Yahoo accounts were directly exposed, since a phished code defeats that second factor entirely.
- Google and Yahoo face immediate pressure to answer for SMS 2FA as a default protection on high-value accounts, because the campaign demonstrated its bypass against their own login flows.
Second-order effects
- The attack path generalizes beyond phishing pages: the Sakari incident showed a $16 text-rerouting purchase could intercept SMS codes outright, and bot markets built on Twilio-scale SMS services now automate code theft against Coinbase, PayPal, and bank accounts — meaning every provider still leaning on SMS inherits the same weakness.
- Email providers and banks are pushed toward hardware security keys and app-based prompts, since the hack-for-hire pricing confirms attackers will pay real money only where the defense is weakest.
Third-order effects
- Government email is structurally migrating away from consumer providers toward hardened infrastructure — a trajectory confirmed when Microsoft disclosed Chinese hackers sitting undetected in US government cloud email for a month, showing the problem follows officials even onto enterprise platforms.
- If SMS 2FA keeps failing against both commodity and state adversaries, regulators face pressure to treat it as inadequate authentication for critical accounts, accelerating a market shift toward phishing-resistant factors.
The trend: Authentication is being forced from SMS codes toward phishing-resistant methods as 2FA-bypass shifts from nation-state tradecraft to a priced, automated service.