Loading story…
Access Now, Lookout, and SMEX reported a suspected hack-for-hire espionage campaign targeting journalists and activists across the Middle East and North Africa through spearphishing, fake social media personas, messaging apps, and sustained social engineering. Researchers said the operation used infrastructure linked to the APT group Bitter and likely deployed ProSpy Android spyware, which can steal files, contacts, messages, and geolocation data, activate microphones and cameras, and install malicious apps. The activity has reportedly been ongoing since at least 2022, with broader targeting that may have included civil society figures and possibly government officials.
Two Egyptian journalists, Mostafa Al-A’sar and Ahmed Eltantawy, were among the identified targets in an elaborate campaign that ran between October 2023 and January 2024 and spoofed trusted services including Apple and Signal. A prominent Lebanese journalist was also reportedly targeted, and researchers said the attackers relied on overlapping infrastructure with possible ties to Asia, though Access Now said it lacked enough evidence to definitively name a sponsor. Neither Egyptian journalist’s accounts were ultimately compromised, but press freedom groups warned that surveillance of reporters endangers their safety, sources, and ability to work.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
By April 13, 2026, reporting on Access Now and Lookout’s findings said Lookout attributed the espionage campaign targeting journalists and opposition figures in the Middle East to the South Asian threat group BITTER, also known as T-APT-17 and APT-Q-37. The attribution was based on code similarities between the ProSpy Android spyware used in the campaign and BITTER’s earlier Dracarys malware.
Following publication of the findings on April 8, 2026, the Committee to Protect Journalists condemned the spying campaign, warning that surveillance of journalists endangers their safety, sources, and ability to work. The statement marked a public response from a press freedom organization to the reported activity.
On April 8, 2026, reporting on the hack-for-hire campaign said it targeted not only Egyptian and Lebanese civil society members but also government officials and other targets connected to Bahrain, Egypt, the UAE, Saudi Arabia, the UK, and potentially the United States between 2023 and 2025. The disclosure marked a broader understanding of the campaign’s scope and victimology than previously captured.
On April 8, 2026, Access Now, Lookout, and SMEX publicly reported the suspected hack-for-hire espionage campaign targeting journalists and activists in the Middle East and North Africa. The report described social-engineering tactics, named victims including Mostafa Al-A’sar and a prominent Lebanese journalist, and said attribution to a specific sponsor remained unconfirmed.
Between October 2023 and January 2024, attackers targeted Egyptian journalists Mostafa Al-A’sar and Ahmed Eltantawy with an elaborate spearphishing operation using fake personas and spoofed Apple and Signal services. The campaign sought access to their Apple and Google accounts and used infrastructure capable of delivering Android spyware, though neither victim’s accounts were ultimately compromised.
Citizen Lab previously found that Ahmed Eltantawy’s phone was targeted again with Intellexa’s Predator spyware in 2023. This was separate from the later spearphishing campaign documented by Access Now and Lookout.
Access Now, Lookout, and SMEX said the broader espionage campaign targeting journalists and activists in the Middle East and North Africa had been active since at least 2022. Researchers linked shared infrastructure in the attacks to Bitter and assessed the operation likely used ProSpy Android spyware.
Citizen Lab previously found that Egyptian journalist Ahmed Eltantawy’s phone was targeted with Intellexa’s Predator spyware in 2021. This establishes earlier surveillance activity against one of the later campaign’s victims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourceinfosec.pub
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked dataset reviewed by the Pegasus Project linked NSO Group’s **Pegasus** spyware to the selection of more than **50,000 phone numbers** by government clients, including journalists, lawyers, activists, and political figures across multiple countries. Amnesty International’s Security Lab examined dozens of devices and found **23 confirmed infections** and **14 attempted compromises**, while Citizen Lab validated parts of the forensic work. Reporting tied suspected targeting to at least 10 governments, with prominent cases involving more than 40 Indian journalists, Moroccan and French reporters including **Edwy Plenel**, and Mexican journalist **Cecilio Pineda Birto**, whose number was reportedly selected shortly before his murder. Further forensic investigations expanded the pattern beyond journalists to civil society groups, including six Palestinian human rights defenders whose iPhones were confirmed hacked in 2020 and 2021. Amnesty also published indicators of compromise and a technical methodology through its GitHub repository and **Mobile Verification Toolkit**, documenting Pegasus infrastructure, suspicious processes, and artifacts associated with zero-click exploitation of Apple services such as **iMessage**. NSO Group denied that the leaked list was a roster of Pegasus targets and disputed the scale of abuse, but the combined reporting and device analysis showed repeated use of the spyware against people outside legitimate criminal or terrorism investigations.
Aug 15, 2026
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to `KISMET` and `FORCEDENTRY`, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, `MANSAF` and `BLACKIRIS`, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims. Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant `Chrysaor` on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Aug 15, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026