AI-Coded Oppression: “RedKitten” Malware Targets Iranian Protesters

HarfangLab identified "RedKitten," a Jan 2026 campaign targeting Iranian protesters and NGOs with malicious Excel spreadsheets that trigger hidden macros to install a modular C# surveillance implant (SloppyMIO); analysts found traces of LLM-assisted development and noted the operators use GitHub, Google Drive and Telegram for configuration and command-and-control, and assess the activity as aligned with Iranian state interests.