iKittens

iKittens is an early FireEye tracking designation for activity later consolidated into the Charming Kitten cluster. The name was used to describe Iranian-linked social media persona operations and spear phishing campaigns targeting US government and military personnel, journalists, and defense contractors, primarily between 2016 and 2017. The group's approach involved establishing fake social media identities to build trust with targets before delivering phishing content. This operational pattern prefigures the sophisticated social engineering tradecraft consistently documented across the broader Charming Kitten/APT35 cluster.