In December 2021, TAG discovered a novel APT35 (Charming Kitten) tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts. The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials. Google has seen the tool deployed against fewer than two dozen accounts located in Iran. The oldest known sample is from 2020, and the tool is still under active development.
HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired. It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail. Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread. After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google. Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.
The tool is written in .NET for Windows PCs and is designed to run on the attacker’s machine. Google TAG tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts. HYPERSCRAPE won’t run unless in a directory with other file dependencies.
https://blog.google/threat-analysis-group/new-iranian-apt-data-extraction-tool/