New AI-Developed Malware Campaign Targets Iranian Protests

**Executive summary:** HarfangLab discovered a targeted campaign (RedKitten) delivering a C# implant called SloppyMIO via password-protected, macro-enabled Excel lures that appear to be forensic lists of protest victims in Iran; the malware supports data theft, remote command execution, modular payload downloads (via GitHub/Google Drive), steganographic configuration, Telegram C2, and persistence, and researchers assessed the activity as likely aligned with Iranian state interests and partially developed using LLM tools.