Hackers have discovered a new way to access and download the inbox data for users of Gmail, Yahoo and Outlook.

According to the Google Threat Analysis Group (TAG), Iranian government sponsored hacking group Charming Kitten has been using a tool called ‘Hyperscrape’ to gain access to the inboxes of around two dozen noteworthy users and download their data.

Hyperscrape was first discovered by the TAG in December last year, but the earliest known instances of the software being used date back to 2020.

The tool works by taking advantage of stolen cookies or account details to access an account. From there, hackers then trick the email service into thinking the browser is outdated, which then shows it in basic HTML. From there, hackers change the language to English and can open and download emails individually.

Covering their tracks, hackers then mark the emails as unread, delete warning emails, return the language back to its original and sneak out.

TAG believes that the known attacks were politically motivated, and despite the way it works quickly and is hard to detect, Google has learned quite a lot about Hyperscrape, reporting that it is written in .NET for Windows.

TAG, who has acquired a copy of the tool for testing and analysis, is yet to test it for Yahoo and Outlook, and has confirmed that it may behave differently to how it does for Gmail.

Cookie stealing is a growing trend in cybercrime according to a Sophos report. This allows hackers to gain access to accounts without needing to worry about multifactor authentication, as the browser already believes that the user is logged into the session.