Surveillance Disguised as Privacy Tools

A campaign orchestrated by an Iran-nexus threat cluster is weaponizing the desire for digital privacy, circulating counterfeit applications designed to compromise the devices of unsuspecting users. By masquerading as functional software, these tools aim to grant external actors administrative control over victims' machines while appearing to offer secure connectivity.

Tactics of the TAG-182 Cluster

Security researchers at Recorded Future's Insikt Group have identified a threat actor they track as TAG-182, which specializes in deploying a remote access Trojan known as MarkiRAT. The campaign circumvents legitimate app stores, opting instead to distribute malicious files through social media channels and external links. Two specific applications have been highlighted in this research: Pis2ray VPN and a media player application named YESHICA.

Following public exposure of the original file, the actors reportedly renamed the media player to YESHICA YEPlayer in March 2026. These tools are engineered to remain covert, often using process names that appear innocuous to the average user. Once active, the software is capable of capturing screenshots and transmitting that data back to attacker-controlled infrastructure.

Subverting System Housekeeping

The persistence of this spyware is attributed to its exploitation of legitimate system processes. MarkiRAT makes use of the Background Intelligent Transfer Service (BITS), which is a native Windows component typically employed for system updates. By masking malicious traffic as routine data fetching, the threat actor significantly lowers the likelihood that standard security software will detect the intrusion.

The underlying malicious payload is not a new development in the regional threat landscape. Previous documentation from Kaspersky has linked earlier iterations of similar surveillance tools to a group identified as Ferocious Kitten, which conducted long-term monitoring operations targeting activists within Iran.

Targeting and Distribution Patterns

The distribution strategy relies on timing campaigns to coincide with periods of social unrest or restricted network access. Investigators observed promotional activity for these tools on platforms like Instagram in the weeks following street protests in late 2025 and throughout the period leading up to the end of a prolonged internet shutdown on 26 May 2026.

• The threat cluster is tracked by researchers as TAG-182.
• The spyware tool identified is known as MarkiRAT.
• The YESHICA media player was renamed to YESHICA YEPlayer in March 2026.
• The country's prolonged internet shutdown ended on 26 May 2026.

Implications for Digital Security

This incident suggests that users in high-risk environments face a heightened danger when attempting to bypass censorship through unverified software. The effectiveness of these lures stems from the fact that individuals in regions with restricted internet access are often forced to look outside official app marketplaces, which in turn creates an opening for state-aligned groups to distribute compromised tools. For the broader industry, the reliance on social media to disseminate surveillance applications underscores a need for greater scrutiny of software sources, even when those applications provide functionality that appears to address an urgent personal need.