CharmingCypress

CharmingCypress is Volexity's tracking name for a subset of Charming Kitten activity focused on targeted espionage against policy experts, journalists, and NGO workers with Middle East expertise. Active since at least 2023, the group uses elaborate multi-stage social engineering — including fake conference invitations and extended email correspondence with targets — before delivering malware or credential harvesting links. CharmingCypress has been documented using novel infection chains targeting both Windows and macOS systems, and shares infrastructure and targeting patterns with the broader Charming Kitten and Mint Sandstorm identities.