Threat Analysis Group (TAG) researchers at Google have published a new report regarding an emerging extortion tool called “HYPERSCRAPE”. HYPERSCRAPE allows the exfiltration of inboxes from Gmail, Yahoo!, and Microsoft Outlook accounts using previously exposed credentials. Researchers detailed that Charming Kitten (APT35), an alleged state-sponsored Iranian hacking group, created this tool and has currently deployed it against fewer than twenty-four (24) accounts located in Iran. The attack begins by the threat actor spoofing a user agent to appear as an outdated browser in order to enable the HTML view and, once logged in using the victim’s account credentials, HYPERSCRAPE “changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.” Once the data is finished downloading, the tool “reverts the language back to its original settings and deletes any security emails from Google.” Researchers noted that the tool’s functionality may differ for Yahoo! and Microsoft Outlook (as they tested the tool with a fake Gmail account), and that this tool is designed to run on the threat actor’s machine. Earlier versions of the tools allowed for data from Google Takeout to also be exfiltrated. In this scenario, the tool will “spawn a new copy of itself and initialize a pip communication channel to relay cookies and account name, both of which are required to accomplish the Takeout.” Once the desired information is received, the tool requests and later downloads the exported data from the official Takeout link. As HYPERSCRAPE is still under active development, CTIX analysts will provide details regarding new advancements as they become available. Indicators of compromise as well as technical details can be viewed in Google’s report linked below.