CRESCENTHARVEST Campaign Targets Iran Protest Supporters With RAT Malware

**CRESCENTHARVEST** is a targeted cyber-espionage campaign, likely Iran-aligned, that uses spear-phishing with double-extension LNK files and a malicious RAR/ZIP chain to sideload rogue DLLs via a Google-signed binary; the payload functions as a RAT and information stealer capable of keylogging, harvesting browser credentials/cookies, Telegram session data, enumerating accounts, and communicating with a C2 at servicelog-information.com.