Crescent Harvest Malware Targets Iranian Protest Supporters

Crescent Harvest Malware Targets Iranian Protest Supporters

First seen 17 Feb 2026, 19:10 UTC •ArabianbusinessAcronisThenationalnewsGlobalsecuritymag.FrCybersecuritynews+5 •80% similarity •39.6

Article Content

Browse articles
ThreatCluster

A new malware campaign named 'Crescent Harvest' has been identified, targeting supporters of protests in Iran. The malware specifically affects Farsi-speaking users seeking information about the demonstrations, coinciding with an internet blackout in the region. Security experts from Acronis first detected the malware in early January 2026.

ThreatCluster AI How this analysis works

Timeline

2026-01-01
Crescent Harvest malware campaign detected
2026-01-01
Targeting of Farsi-speaking users begins
2026-02-17
Articles published detailing the malware campaign

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

ClickFix AstarionRAT Crescent Harvest Matanbuchus Crescentharvest Crescentharvest Malware Campaign RedKitten AI-accelerated Campaign