Loading story…
Syrian activists were hit by a sustained surveillance campaign that combined Facebook phishing with malware-laced files masquerading as revolutionary documents and other trusted content. Electronic Frontier Foundation reporting described attackers stealing account credentials through fake login pages and deploying remote-access trojans to monitor victims, with one later campaign using the commercially available BlackShades malware to capture data and maintain access to compromised systems.
A separate EFF report said Vietnamese activists also faced highly personalized malware operations, indicating that threat actors tailored lures and surveillance tools to specific individuals and their relationships. Taken together, the incidents showed politically motivated targeting of dissidents through social engineering, credential theft, and commodity as well as custom malware designed to spy on activists and their networks.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
EFF documented a Vietnamese malware campaign that had become highly personalized, suggesting attackers were tailoring lures and targeting to specific individuals. The reporting highlighted a more intimate and deliberate form of surveillance against Vietnamese activists or dissidents.
EFF reported that malware targeting Syrian activists included the Blackshades remote access trojan, a commercially available surveillance tool. This revealed additional technical detail about the tooling used in the campaign.
EFF disclosed a trojan distributed inside fake revolutionary documents aimed at Syrian activists. The lures were crafted to appear relevant to the Syrian uprising, indicating continued refinement of social-engineering methods.
A new wave of Facebook phishing attacks was reported against Syrian activists, showing attackers were using credential theft alongside malware to gain access to accounts. The activity represented a distinct tactic in the broader targeting campaign.
EFF reported a campaign using surveillance malware to target Syrian activists, marking an escalation in digital attacks against opposition figures. The reporting indicated the malware was being used to monitor victims and compromise their communications.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourceeff.org
Open sourceeff.org
Open sourceeff.org
Open sourceeff.org
Open sourceeff.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Syrian activists were targeted with multiple remote access trojans, including **BlackShades RAT**, **Xtreme RAT**, and **DarkComet**, in campaigns linked to the **Syrian Electronic Army**. Reporting cited **Citizen Lab** findings that BlackShades was used against activists, while separate observations tied Xtreme RAT and DarkComet to related activity in Syria. The malware appeared to be rotated across campaigns, suggesting operators shifted between commodity RAT families while maintaining the same targeting focus. One lure used a fake Skype encryption tool to disguise **DarkComet**, showing how social-engineering themes were paired with off-the-shelf surveillance malware to compromise victims. Publicly shared indicators included sample names, file sizes, and **MD5** hashes for BlackShades, Xtreme RAT, and DarkComet specimens, underscoring how the campaigns relied on readily available RATs rather than bespoke implants to monitor and control infected systems.
Aug 15, 2026
Access Now, Lookout, and SMEX reported a suspected **hack-for-hire espionage campaign** targeting journalists and activists across the Middle East and North Africa through spearphishing, fake social media personas, messaging apps, and sustained social engineering. Researchers said the operation used infrastructure linked to the APT group **Bitter** and likely deployed **ProSpy** Android spyware, which can steal files, contacts, messages, and geolocation data, activate microphones and cameras, and install malicious apps. The activity has reportedly been ongoing since at least 2022, with broader targeting that may have included civil society figures and possibly government officials. Two Egyptian journalists, **Mostafa Al-A’sar** and **Ahmed Eltantawy**, were among the identified targets in an elaborate campaign that ran between October 2023 and January 2024 and spoofed trusted services including Apple and Signal. A prominent Lebanese journalist was also reportedly targeted, and researchers said the attackers relied on overlapping infrastructure with possible ties to Asia, though Access Now said it lacked enough evidence to definitively name a sponsor. Neither Egyptian journalist’s accounts were ultimately compromised, but press freedom groups warned that surveillance of reporters endangers their safety, sources, and ability to work.
Jun 29, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026