Google’s Threat Analysis Group (TAG) reportedly identified HYPERSCRAPE, a tool associated with an Iranian-linked espionage operation that could retrieve email from Gmail, Yahoo, and Outlook accounts after an attacker gained access. But reported capability is not proof that every service was targeted: a contemporaneous account of Google’s findings said apparent use involved fewer than two dozen accounts located in Iran, while deployment against Yahoo or Outlook was unclear.
What Google reportedly found
Google TAG reportedly detected HYPERSCRAPE in December 2021. The oldest known sample was dated to 2020, according to CyberScoop’s August 23, 2022 report, which attributed the findings to Google TAG and security engineer Ajax Bash.
The report said the tool appeared to have been used against fewer than two dozen accounts located in Iran. That is a bounded figure in the report, not a complete count of all possible activity, and it does not establish how many people were affected overall.
Google’s findings were reported through CyberScoop rather than in the original HYPERSCRAPE post, so the operational details below should be understood as that outlet’s account of what Google described.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Could it steal email from Gmail, Yahoo, and Outlook?
| Email service | What the report established |
|---|---|
| Gmail | HYPERSCRAPE was described as capable of retrieving messages from Gmail accounts after the attacker had account access. The reported apparent deployments were against accounts located in Iran; the report did not provide a Gmail-specific victim count. |
| Yahoo | Named as a service the tool could target. Whether Yahoo accounts had actually been targeted was unclear. |
| Outlook | Named as a service the tool could target. Whether Outlook accounts had actually been targeted was unclear. |
The important distinction is between a tool’s stated reach and confirmed use against a particular provider. The report did not establish that Yahoo and Outlook users were among the apparent victims.
How HYPERSCRAPE reportedly worked
HYPERSCRAPE was not described as a remote, unauthenticated exploit. Its reported use required an existing logged-in account session or attacker possession of the account credentials.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
According to CyberScoop’s account of Bash’s description, the tool changed the account’s language setting to English, downloaded messages individually, marked them unread, and deleted security emails triggered by its activity. Older versions could also request Google Takeout data; later versions reportedly removed that feature for reasons that were not known.
Bash characterized the tool as not especially technically sophisticated, but effective at achieving the operation’s objectives. His statement was quoted in CyberScoop’s report, not independently reviewed here.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
Who was behind the tool?
The reporting described HYPERSCRAPE as likely associated with Charming Kitten, an Iranian-linked espionage operation. Treat that as a qualified attribution, not a definitive identity claim: threat reporting can use different names for groups and operations, and the available account does not establish that every Iranian-linked campaign or vendor label refers to one identical organization.
How this differs from other Google reporting on Iranian-linked threats
Google TAG’s October 2021 background on APT35 described phishing campaigns targeting Gmail, Hotmail, and Yahoo credentials, sometimes seeking second-factor codes. It advised users to take government-backed attacker warnings seriously. Such a warning means Google identified the person as a target; it does not, by itself, mean the account was compromised. This is context about separate phishing activity, not evidence that HYPERSCRAPE victims were targeted in the same way. Google TAG’s October 14, 2021 post explains that guidance.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
In a separate August 2024 report about APT42 campaigns, Google TAG described account resets, warnings to targets, detection updates, and disruption of attacker infrastructure. It recommended that high-risk users consider Google’s free, opt-in Advanced Protection Program. Those measures and the recommendation relate to the later APT42 reporting, not a HYPERSCRAPE-specific response. Google TAG’s August 14, 2024 post provides that later account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What email users can take from the report
HYPERSCRAPE’s reported prerequisites matter: the account had to be logged in or the attacker needed credentials. The report does not say that merely using Gmail, Yahoo, or Outlook exposed an account to an automatic remote attack. For users at elevated risk, Google’s later general guidance points to its free, opt-in Advanced Protection Program; the 2024 recommendation should not be mistaken for a remedy created specifically for HYPERSCRAPE.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
