The spyware is called EyeSpy which is a legit software used to monitor employees' activities. This Iranian-based software is being used by "malicious" actors to infect user's and spy on their activities.
This seems to be happening since May 2022 and specially in September after anti-government protest began (more info about this: https://www.euronews.com/2022/12/20...neration-z-will-the-unrest-lead-to-revolution)
Since other providers were blocked in the country, these smaller, third-party VPNs saw a huge widespread use.
Sources:
https://www.techradar.com/news/spyware-found-stealing-iranian-user-data-via-infected-vpn-installer
https://thehackernews.com/2023/01/beware-tainted-vpns-being-used-to.html
This seems to be happening since May 2022 and specially in September after anti-government protest began (more info about this: https://www.euronews.com/2022/12/20...neration-z-will-the-unrest-lead-to-revolution)
Since other providers were blocked in the country, these smaller, third-party VPNs saw a huge widespread use.
Sources:
https://www.techradar.com/news/spyware-found-stealing-iranian-user-data-via-infected-vpn-installer
https://thehackernews.com/2023/01/beware-tainted-vpns-being-used-to.html