Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Operation Newscaster was the name iSIGHT Partners gave to a reported cyber-espionage campaign active since at least 2011. Rather than relying only on advanced malware, the operators built a convincing online world: invented journalists and professionals, a counterfeit news site, and social-media relationships with U.S. officials and the people around them. Those relationships were later used to deliver links to spoofed login pages and other malicious destinations.
Contemporaneous reporting described the activity as Iran-linked, not as a publicly proven operation directed by Iran’s government. Researchers also could not establish how many accounts were compromised or what information, if any, was stolen.
What Operation Newscaster was
iSIGHT Partners reported that the campaign, which it called NEWSCASTER, had operated since at least 2011. Its reported objective was intelligence collection through patient relationship-building on social networks. The campaign’s strength was deception and persistence rather than unusually sophisticated technical tooling.
More than a dozen fabricated personas were reportedly used. Some presented themselves as journalists or other professionals whose backgrounds could plausibly attract people working in government, defense, policy and the media.
#1 Best Overall
How the social-media operation worked
1. Creating believable identities
The operators assembled profiles with names, job histories, photographs and professional interests intended to look authentic. They did not limit their activity to direct approaches to senior officials; they also connected with people in those officials’ wider circles.
2. Using a fake news outlet as supporting evidence
A counterfeit site called NewsOnAir.org republished genuine news stories under invented bylines. The site gave the fabricated journalists a publication history that could make a new social-media contact appear legitimate when someone checked the profile.
Rank #2
- Cybersecurity.
- This merchandise, which shows a computer cybersecurity word cloud design, is ideal for computer programmers, coders, and hackers. It is also for software engineer or software developers, as well as information technology or computer science majors.
- Hardcover journal with 240 line-ruled pages (120 sheets)
- Built-in elastic closure and ribbon bookmark
- Includes an expandable inner storage pocket and a pen holder
3. Building a network around high-value targets
According to iSIGHT’s reporting, the personas connected with intended targets as well as friends, relatives, colleagues and other professional contacts. The Washington Post reported more than 2,000 connections. That number describes the campaign’s social network—not 2,000 confirmed victims, hacked accounts or people who necessarily opened a malicious link.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Sending credential-theft and malware links
After trust had been established, operators sent messages containing links to fake websites, including spoofed email sign-in pages designed to capture usernames and passwords. Reporting also described malicious links and malware. It does not show that every contact received a payload, clicked a link or surrendered credentials.
Who the campaign reportedly targeted
The reported network included people connected to several sensitive sectors:
- Senior U.S. military personnel
- Foreign-policy officials
- Members of Congress
- Journalists and lobbyists
- Think-tank employees
- Defense-contractor personnel
Reaching a colleague, relative or friend could provide a less suspicious path toward information about a senior figure than approaching that person directly. The method also increased the chance that a malicious message would arrive through a relationship the recipient already considered credible.
Rank #4
- Funny design. if you are a cybersecurity engineer and you love to work with computer science this will be a great outfit for you to wear. People who like programming, hackers and hacking will like this fantastic IT security outfit.
- Awesome for men,woman,sister,brother,mother,dad and friends who like anti malware technicians. A great gift idea for birthday,christmas or any other occasion.Get this present to have the best information security workers outfit.
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
What is known—and not known—about the results
| Reported figure or finding | What it means |
|---|---|
| Active since at least 2011 | iSIGHT Partners’ estimate of when the campaign began; it is not a precise start date. |
| More than a dozen fabricated personas | The number of fake identities reported by iSIGHT, as covered by SecurityWeek. |
| More than 2,000 connections | A 2014 iSIGHT figure reported by The Washington Post for social relationships, including contacts around intended targets. |
| Confirmed compromised accounts | Not established in the available reporting. |
| Amount or type of data stolen | Not established. iSIGHT researchers said they could not determine what information had been taken. |
Potential access to military dispositions, weapons-related information or diplomatic positions was discussed as a possible intelligence value, not as a verified description of what the operators obtained.
Why the approach was effective
The campaign exploited a basic weakness in online trust: people often judge a contact by apparent professional history and mutual connections before inspecting the destination of a link. A real article, a plausible byline and several shared contacts can make a malicious request feel routine.
Best Value
- Are you an ethical computer data security hacker that detects attack internet systems & loves cyber security hacking war games? This distressed vintage graphic design quote saying CYBERSECURITY BLUE TEAM is then for you to have & gift to team blue hackers.
- Classic five-panel structured baseball hat with high-profile crown
- Adjustable fit; one size fits most adults
iSIGHT senior vice president Tiffany Jones summarized the balance of methods by saying, “What they lack in technical sophistication they make up for in creativity and persistence.” John Hultquist, then iSIGHT’s head of intelligence on cyber-espionage, said, “The social networking is so elaborate they’ve got connections to the highest levels of American policy.” Both statements were made in their iSIGHT Partners roles during the 2014 reporting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How strong was the attribution to Iran?
Contemporaneous coverage characterized Newscaster as believed to be Iran-linked or of suspected Iranian origin. The available reporting does not prove that Iran’s government ordered or directly controlled the campaign. Attribution should therefore be stated cautiously: iSIGHT Partners reported the activity and linked it to Iran, while the public evidence did not establish state direction as a fact.
Newscaster versus later Iran-linked operations
Several later stories involve Iran-linked actors but should not be merged with Newscaster. The publicly described cases differ in date, objective and reported methods.
| Case | Period | Reported focus and methods | Attribution and scope |
|---|---|---|---|
| Operation Newscaster | At least 2011; reported in 2014 | Relationship-building through fake professional personas and a counterfeit news site, followed by credential-harvesting and other malicious links. | iSIGHT described it as Iran-linked; stolen data and confirmed victim counts were not established. |
| Justice Department case announced in September 2024 | Alleged activity beginning around January 2020 | Spearphishing, social engineering, access to campaign-related accounts and attempted release of stolen material before the 2024 U.S. presidential election. | The indictment concerned three alleged IRGC employees. The available sources do not establish that they were Newscaster operators. |
| Meta takedown reported in August 2026 | 2026 | Four Facebook accounts and 31 Instagram accounts reportedly linked to Iran-based actors; personas posed as U.S.-based activists, students and designers, with AI used for some political content. | Axios reported about 79,400 Instagram accounts followed at least one inauthentic account. That follower figure belongs to this separate network, not Newscaster. |
The State Department’s Rewards for Justice program offered up to $10 million for information related to the 2024 election-interference case. That reward and its associated figures do not describe Operation Newscaster.
Quick Recap
Practical lessons from the campaign
- Mutual connections are not proof of identity. A familiar name or shared colleague can be part of a constructed network.
- Verify the person and the destination separately. Check a contact through an independently known channel and inspect link domains before signing in.
- Treat unsolicited login prompts as hostile until confirmed. Navigate to the organization’s known website or use a bookmarked service instead of entering credentials from a message.
- Protect the wider network. Security checks should include assistants, relatives, colleagues and professional contacts, not only senior decision-makers.
- Do not equate reach with compromise. A large connection count measures exposure and opportunity; it does not prove successful intrusion.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
