The Fata Morgana campaign, executed by suspected Iranian nation-state hackers (Tortoiseshell), employed watering hole attacks to compromise trusted maritime industry websites frequented by Israeli shipping and logistics professionals. By injecting obfuscated malicious JavaScript, attackers triggered multi-stage malware payloads on visitors' systems, conducting reconnaissance to identify high-value targets. The operation leveraged unpatched browser vulnerabilities, encrypted C2 communications, and rotating servers to evade detection, enabling deep infiltration into critical infrastructure.The attack’s strategic disruption aimed at Israel’s maritime sector—a vital economic pillar—suggests intent to undermine trade operations, supply chains, or port logistics. While no explicit data breaches or ransomware were confirmed, the state-sponsored sophistication and targeting of sector-wide systems imply potential for large-scale operational outages, economic destabilization, or cascading failures in logistics networks. The low-confidence attribution to Iran further escalates geopolitical tensions, aligning with patterns of cyber-enabled economic warfare rather than isolated criminal activity.