Nation-State

Iranian Hackers Targeted WhatsApp Accounts of Staffers in Biden, Trump Administrations, Meta Says

Meta said it discovered a network of Iranian hackers, who posed as tech support agents for companies including AOL, Microsoft, Yahoo and Google.

Meta said it discovered a network of Iranian hackers, who posed as tech support agents for companies including AOL, Microsoft, Yahoo and Google.

The same Iranian hacking group believed to have targeted both the Democratic and Republican presidential campaigns tried to go after the WhatsApp accounts of staffers in the administrations of President Joe Biden and former President Donald Trump, Meta Platforms said Friday.

Meta said it discovered the network of hackers, who posed as tech support agents for companies including AOL, Microsoft, Yahoo and Google, after individuals who received the suspicious WhatsApp messages reported them. Meta’s investigators linked the activity to the same network blamed for the hacking incident reported by Trump’s campaign.

The FBI this week said a hack by Iran of the Trump campaign and an attempted breach of the Biden-Harris campaign was part of a broader Iranian effort to interfere with the U.S. presidential election.

A statement Friday from Meta, the parent of Facebook and Instagram, said that the hackers had tried to target the WhatsApp accounts of individuals in the Middle East, the United States and the United Kingdom, as well as political and diplomatic officials — including unidentified officials associated with the Trump and Biden administrations. A “small cluster” of accounts was blocked by Meta, the company said.

“We have not seen evidence of the targeted WhatsApp accounts being compromised, but out of an abundance of caution, we’re sharing our findings publicly, in addition to sharing information with law enforcement and our industry peers,” Meta said in a statement.

In a report this month, Google’s threat intelligence arm said the same Iranian group, which it linked to the country’s Revolutionary Guard, had tried to infiltrate the personal email accounts of roughly a dozen people linked to Biden and Trump since May. That report expanded on a separate study released days earlier by Microsoft that revealed suspected Iranian cyber intrusion in this year’s presidential election.

Advertisement. Scroll to continue reading.

U.S. intelligence officials say Iran’s increasingly aggressive use of cyberattacks and disinformation has several motives: to confuse and polarize voters in an effort to undermine confidence in U.S. democracy, to erode support for Israel, and to oppose candidates that it believes will increase tension between Washington and Iran.

Iran has vowed revenge against Trump, whose administration ended a nuclear deal with Iran, reimposed sanctions and ordered the killing of an Iranian Gen. Qassem Soleimani.

In July, Director of National Intelligence Avril Haines said Iran’s government gave covert support to American protests against Israel’s war against Hamas in Gaza. Groups linked to Iran posed as online activists, encouraged campus protests and provided financial support to some protest groups, Haines said.

Messages left with the Trump and Harris campaigns were not immediately returned Friday.

Related: Iran Is Accelerating Cyber Activity That Appears Meant to Influence the US Election, Microsoft Says

Related Content

Cybercrime

Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad.

Government

Homeland Security Secretary Markwayne Mullin tasked CISA with developing the plan in July. 

Malware & Threats

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

Identity & Access

When Android users get a call from a non-contact, they will see more information about the caller, including their country.

ICS/OT

The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks.

Cyberwarfare

The 17 members of the Mabna Institute targeted hundreds of universities and organizations in the US and abroad.

Fraud & Identity Theft

Signal has also made a security announcement: an automatic key verification feature to complement its safety number system.

ICS/OT

Georgia has been confirmed as one of the attacked states after Clayton County reported a pump station disruption.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version