The UK has issued a warning about the threat from cyber attackers working on behalf of the Iranian state.

In an advisory published with US partners, the National Cyber Security Centre (NCSC) – part of GCHQ – shared details of how cyber attackers working for Iran’s Revolutionary Guard Corps (IRGC) are using social engineering techniques to gain access to victims’ personal and business accounts online.

According to the NCSC, the malicious activity is targeted at individuals with a link to Iranian and Middle Eastern affairs, including current and former senior government officials, senior think tank personnel, journalists, activists and lobbyists.

The US has also observed the targeting of people associated with domestic political campaigns.

The advisory said the attackers often impersonate contacts on email and messaging platforms, building a rapport with targets before soliciting them to share user credentials on a false email account login page.

The attackers can then gain access to the victims’ accounts, exfiltrate and delete messages and set up email forwarding rules.

This activity “poses an ongoing threat to various sectors worldwide, including the UK”, the NCSC said.

To reduce the chances of being affected, the organisation advised at-risk individuals to follow the mitigation steps in the advisory.

The NCSC also suggested following its guidance and taking advantage of its free cyber defence tools.

Paul Chichester, NCSC director of operations, said: “The spear-phishing attacks undertaken by actors working on behalf of the Iranian government pose a persistent threat to individuals with a connection to Iranian and Middle Eastern affairs.

“With our allies, we will continue to call out this malicious activity, which puts individuals’ personal and business accounts at risk, so they can take action to reduce their chances of falling victim.

“I strongly encourage those at higher risk to stay vigilant to suspicious contact and to take advantage of the NCSC’s free cyber defence tools to help protect themselves from compromise.”