TA453, an Iranian-state aligned actor, masqueraded as British scholars to covertly target individuals of intelligence interest to the Iranian government in what Proofpoint has dubbed Operation SpoofedScholars. The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page. The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites. Proofpoint has worked with the appropriate authorities to conduct victim notification