Loading story…
Researchers reported that the Iranian-linked Domestic Kitten surveillance operation, also tracked as APT-C-50, deployed an updated version of its FurBall Android spyware in campaigns targeting Iranian citizens. The malware was delivered through fake websites impersonating legitimate services, including a spoofed English-to-Persian translation site that served a malicious APK named sarayemaghale.apk. Analysis found the newer FurBall variant preserved core spying capabilities while adding obfuscation and refreshed command-and-control infrastructure, helping it evade antivirus detection more effectively than earlier samples.
Domestic Kitten has been tied to a broader long-running surveillance program that used tailored Android apps to monitor specific ethnic, political, and religious groups, including Kurds, Sunni Muslims, ISIS supporters, and other Iranian targets. Earlier research linked the operation to hundreds of victims and showed the spyware could steal screenshots, messages, call logs, ambient audio, contacts, and files from infected devices. In the latest sample, the app requested only contacts and storage permissions—likely to reduce suspicion—while polling its C2 server over HTTP every 10 seconds, underscoring the group’s continued focus on covert mobile surveillance.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers said the earliest malicious Android samples linked to the Domestic Kitten surveillance campaign dated back to 2016. Later reporting also described the FurBall surveillance operation as active since at least 2016.
ESET analyzed a newer FurBall Android spyware sample used in surveillance campaigns targeting Iranian citizens and attributed it to Domestic Kitten/APT-C-50. The sample retained similarities to earlier versions but added obfuscation and updated command-and-control infrastructure while being distributed via fake websites impersonating legitimate services.
Researchers investigating Domestic Kitten said they confirmed the operation's suspected Iranian origin after accessing logs uploaded from infected devices to command-and-control servers. Those logs also showed the campaign had hundreds of victims across targeted groups including Kurds, Sunni Muslims, ISIS supporters, and Iranian citizens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that the **Rampant Kitten** espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including **Telegram Desktop** files, **KeePass** password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime. Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including **TelB**, **TelAndExt**, a Python infostealer, and **HookInjEx**. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Aug 15, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026