RedKitten Campaign Steals Browser Data from NGOs & Activists

Iran-Linked RedKitten Campaign Targets NGOs with Browser Data Theft

• A cyber campaign dubbed "RedKitten," linked to Iran, is actively targeting human rights NGOs and activists, particularly those focusing on Iran, with sophisticated social engineering and custom malware.
• The campaign utilizes persistent communication and a custom .NET-based malware, "NekoBait," which includes a module specifically designed to exfiltrate sensitive browser information like history, cookies, and cryptocurrency wallet data.
• The threat actor behind RedKitten employs highly personalized phishing and social engineering tactics, building trust with targets over weeks or months before delivering malicious payloads disguised as legitimate documents.

Source: The Hacker News | Date: January 31, 2026

References

1. Iran-Linked RedKitten Cyber Campaign Targets Human Rights NGOs and Activists - The Hacker News