Hack-for-hire group exposed targeting Android and iCloud users

Security researchers from Lookout and Access Now exposed a hack-for-hire group running coordinated attacks on Android devices and iCloud backups

The campaign combined Android spyware infections with phishing attacks designed to steal iCloud credentials from victims

The operation targeted individuals in the Middle East with sophisticated surveillance tools that could extract sensitive data from compromised devices

The discovery shows how mercenary hacking groups are evolving tactics to attack multiple platforms simultaneously

A sophisticated hack-for-hire operation has been caught red-handed running a coordinated spying campaign targeting both Android devices and iCloud accounts, according to new research from security firms. The group deployed custom Android spyware while simultaneously launching phishing attacks to steal iCloud credentials, giving them dual pathways into victims' digital lives. The discovery highlights how mercenary hackers are increasingly combining mobile malware with cloud-based attacks to maximize their reach.

Security researchers just pulled back the curtain on a hack-for-hire operation that's been running a sophisticated dual-platform spying campaign. The group targeted both Android devices with custom spyware and Apple users through iCloud phishing attacks, according to new findings from mobile security firm Lookout and digital rights organization Access Now .

The campaign represents a troubling evolution in mercenary hacking tactics. Rather than focusing on a single platform, these operators built infrastructure to attack victims across the mobile ecosystem. Their Android spyware could silently extract messages, contacts, location data, and other sensitive information from infected devices. Meanwhile, their phishing operation aimed to steal iCloud credentials, potentially giving attackers access to victims' backed-up photos, documents, and device data stored in Apple's cloud.

Researchers traced the operation to targets primarily located in the Middle East, though the exact identity of the victims and who hired the hackers remains unclear. The geographic focus suggests the campaign may have been commissioned by clients interested in surveillance of specific individuals or groups in that region. Hack-for-hire groups typically operate as mercenaries, selling their intrusion capabilities to governments, private investigators, or other clients willing to pay for illegal access to target devices.

The Android spyware component showed notable technical sophistication. The malware masqueraded as legitimate applications while running surveillance functions in the background. Once installed, it established persistent access to compromised devices, allowing operators to continuously monitor targets over extended periods. The spyware's ability to operate stealthily made detection difficult for average users who might not notice unusual battery drain or data usage patterns.