The phishing attacks, which can bypass two-factor authentication, are being carried out by the regime using customized technologies purchased on the dark web, with around 50 targets from the Kurdish community and other prominent figures in the Iranian diaspora being affected.