Back Ground.News

Hack-for-hire spyware campaign targets journalists in Middle East, North Africa

Ground.News • April 9, 2026

Security researchers exposed a spying campaign by a hack-for-hire group that used Android spyware and phishing to steal iCloud credentials and hack victims’ devices.

An apparent hack-for-hire campaign from a group with suspected Indian government connections targeted Middle Eastern and North African journalists and activists using spyware, three collaborating organizations said in reports published Wednesday. The attacks shared infrastructure that pointed to the advanced persistent threat group known as Bitter, which most frequently targets government, military, diplomatic and critical infrastructure sectors…

An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and government officials across the Middle East and North Africa (MENA), according to findings from Access Now, Lookout, and SMEX. Two of the targets included prominent Egyptian journalists and government critics, Mostafa

Security researchers have uncovered a hack-for-hire operation targeting journalists, activists, and officials across the Middle East and North Africa, according to a report by TechCrunch. The investigation, conducted by digital rights group Access Now, mobile cybersecurity firm Lookout, and SMEX, documented multiple cyberattacks between 2023 and 2025. The cases involved two Egyptian journalists and one […] Thank you for subscribing to our RSS fe…

An investigation by several cybersecurity and digital rights organizations identified a hack-for-hire group that reportedly led campaigns against journalists, activists and officials in the Middle East and North Africa, using phishing, access to iCloud copies, attacks on Signal and spyware for Android. *** Lookout, Access Now and SMEX documented attacks between 2023 and 2025 against journalists from Egypt and Lebanon. Hackers sought to steal App…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hack-for-Hire Campaign Targets Journalists in MENA Using Phishing and Spyware A hack-for-hire operation has been uncovered targeting journalists and activists across the Middle East and North Africa, particularly focusing on Egyptian and Lebanese individuals. The campaign, attributed to a group known as BITTER, employed sophisticated spear-phishing attacks to compromise iCloud and Signal accounts, as well as deploying Android spyware disguised as legitimate applications. The attacks were documented by Access Now, Lookout, and SMEX, revealing a timeline of incidents from 2023 to 2025. Notable victims include Egyptian journalists Mostafa Al-A’sar and Ahmed Eltantawy, both of whom have faced political repression. The malware used, identified as ProSpy, allows attackers to extract sensitive data from compromised devices. The operation is suspected to be linked to the Indian government, highlighting a trend of governments outsourcing cyber operations to private firms. Current status indicates ongoing risks for targeted individuals, with calls for improved digital security practices among at-risk communities. 18 sources 76

Extracted Entities

Hack-for-hire spyware campaign targets journalists in Middle East, North Africa

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Companies (1)

Countries (2)

Industries (1)

MITRE ATT&CK (1)

Platforms (2)