Iranian Hackers Use Fake Job Postings to Target Aviation and Energy Firms Amid War

After U.S. and Israeli airstrikes on Iran in late February 2026, Iranian hackers launched a recruitment-fraud operation targeting software engineers at airlines, airports, and oil-and-gas firms. They posted AI-generated senior-engineer ads and infected video-conferencing tools with malware to capture credentials that could reveal flight manifests or oil-market data. Unit 42 linked the scheme to the asymmetric cyber threats warned about by U.S. intelligence.

CNN

Unit 42 of Palo Alto Networks uncovered the campaign. Aviation ISAC, a global airline cyber-information sharing group, monitored the threat; its president Jeffrey Troy spoke. Iranian cyber units tied to Tehran’s “Cyber Warfare” umbrella are the alleged perpetrators. The FBI declined comment; the Iranian UN mission has not responded.

CNN

Late Feb 2026 – U.S. and Israel strike Iranian sites, prompting cyber alerts.

CNN

Mar 2026 – Israeli forces claim a strike on a “Cyber Warfare headquarters.”

CNN

May 2026 – Unit 42 details the fake-job-posting campaign; Aviation ISAC confirms war-linked attacks were anticipated.

CNN

The scheme targeted software engineers with privileged access at a U.S. airline (via a fabricated senior-engineer posting), a U.S. oil-and-gas firm, and entities in Israel and the UAE. Unit 42 notes other unnamed organizations were compromised, but none of the primary aviation or energy firms were breached.

CNN

Aviation ISAC president Jeffrey Troy warned the sector expected such attacks and cited a rise in “fake IT worker schemes” exploiting help-desk processes. Unit 42 stressed data show the hackers “did not successfully breach any of the oil, gas or aviation firms targeted.” The FBI declined comment; the Iranian UN mission has not replied.

CNN

U.S. officials argue compromised credentials could let Iran monitor critical infrastructure, a risk heightened by Iran’s limited conventional strike capability. Prior break-ins at U.S. gas-station tank readers, linked to Iranian hackers, highlight concrete safety hazards.

CNN

Unit 42 reports no successful breach of primary targets but acknowledges undisclosed compromises elsewhere, leaving full scope unknown. The Israeli claim of striking a “Cyber Warfare headquarters” lacks independent verification of operative casualties. Researchers declined to name the other compromised entities.

CNN

> “We have been expecting attacks as a consequence of the war.” — Jeffrey Troy, President, Aviation ISAC

CNN

> “In the bigger picture, we have seen fake IT worker schemes and attempts to get credentials by abusing the help desks at companies.” — Jeffrey Troy, President, Aviation ISAC

CNN

> “We do not believe the hackers successfully breached any of the oil, gas or aviation firms targeted.” — Unit 42 researchers, Palo Alto Networks

CNN

> “To orchestrate sustained, adaptive global cyber campaigns.” — Unit 42 researchers, Palo Alto Networks

CNN

Unit 42 says the Iranian group continues “to orchestrate sustained, adaptive global cyber campaigns,” indicating ongoing attempts to infiltrate aviation and energy networks. Industry watchdogs expect more fake-recruiter schemes, while U.S. and Israeli cyber-defense teams stay on heightened alert.

CNN