Iranian-tied threat actors are utilizing multiple personas in a new phishing campaign targeting users and organizations involving Israel, Gulf States, Abraham Accords, and nuclear weapons. These threat actors have been connected to TA453 (Cobalt Illusion, Charming Kitten), which is a threat organization that conducted several long-term cyberespionage operations on behalf of the Islamic Revolutionary Guard Corps. In previous operations, TA453 have targeted government military personnel, journalists, and academics in sophisticated social engineering attacks. The recent social engineering operation carried out by TA453 involves threat actors spoofing legitimate employee email accounts from PEW Research Center, Foreign Policy Research Institute, UK’s Chatham House, and Nature scientific journal. These spoofed accounts allow threat actors to create email threads with multiple other spoofed accounts to make communications appear legitimate to users; this technique is classified as “Multi-Persona Impersonation” (MPI). Once the victim is lured, TA453 threat actors will embed a malicious URL for the user to download an infected Microsoft Word file that delivers a customized payload to the victim’s device. With MPI becoming a more viable tactic in phishing campaigns, CTIX urges users to validate the integrity of all email communications prior to downloading any attached documents or visiting embedded links to lessen the risk of threat actor compromise.