5259

On 29 January 2026 HarfangLab published a report on a new Iranian state-sponsored espionage campaign named "RedKitten" that since December 2025 targeted regime-critical individuals abroad via WhatsApp, Instagram, and Telegram; attackers used phishing (fake WhatsApp verification codes and a counterfeit WhatsApp Web page with an attacker-controlled QR code) to fully compromise victims' WhatsApp accounts and access messages, browser data, camera, microphone, and location.