Charming Kitten, also known as Phosphorus, APT35, or Ajax Security Team, posed as Farnaz Fassihi, a New York Times journalist with over 17 years of experience. The hacker group used the email address ‘farnaz.fattihi[at]gmail[dot]com’ to lure the recipient on clicking on links that ultimately lead to stealing email credentials. The hackers directed the victim to download the questions from a page hosted on Google Sites that had the WSJ logo.
Source: https://www.bleepingcomputer.com/news/security/charming-kitten-hackers-impersonate-journalist-in-phishing-attacks/