An Iranian threat actor discovered earlier this year is responsible for raids against U.S. targets designed to hoover up Gmail and Instagram credentials, according to research by SafeBreach.