Back Globalsecuritymag.Fr

New espionage malware targeting Iranian protesters and diaspora activists

Globalsecuritymag.Fr • February 17, 2026

Acronis Threat Intelligence has uncovered a new malware campaign, dubbed CRESCENTHARVEST, using protest-themed files to target Iranian protesters and diaspora activists across multiple countries.

Acronis researchers analysed the activity and found it leverages authentic protest media and Farsi-language "frontline updates" as a lure, before deploying a custom espionage payload designed for long-term surveillance. Full research here.

Protest-themed images and videos were used as a lure to trick targets into opening malicious files The malware was designed to look legitimate by abusing trusted software, helping it evade detection Once installed, it enabled long-term surveillance and theft of sensitive data, including Telegram and browser information

What stands out is how directly the campaign weaponises protest-related information itself, exploiting demand for updates during political unrest and turning it into an infection vector.

New, you can have your Podcast here. us for more information ask: Marc Brami Phone: +33 1 40 92 05 55 Mail: [email protected]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Crescent Harvest Malware Targets Iranian Protest Supporters A new malware campaign named 'Crescent Harvest' has been identified, targeting supporters of protests in Iran. The malware specifically affects Farsi-speaking users seeking information about the demonstrations, coinciding with an internet blackout in the region. Security experts from Acronis first detected the malware in early January 2026. 10 sources 40

New espionage malware targeting Iranian protesters and diaspora activists

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)