Hack-for-Hire Campaign Targets Journalists in MENA Using Phishing and Spyware

A hack-for-hire operation has been uncovered targeting journalists and activists across the Middle East and North Africa, particularly focusing on Egyptian and Lebanese individuals. The campaign, attributed to a group known as BITTER, employed sophisticated spear-phishing attacks to compromise iCloud and Signal accounts, as well as deploying Android spyware disguised as legitimate applications. The attacks were documented by Access Now, Lookout, and SMEX, revealing a timeline of incidents from 2023 to 2025. Notable victims include Egyptian journalists Mostafa Al-A’sar and Ahmed Eltantawy, both of whom have faced political repression. The malware used, identified as ProSpy, allows attackers to extract sensitive data from compromised devices. The operation is suspected to be linked to the Indian government, highlighting a trend of governments outsourcing cyber operations to private firms. Current status indicates ongoing risks for targeted individuals, with calls for improved digital security practices among at-risk communities.

Key Points: • Hack-for-hire group BITTER targeted journalists in MENA using phishing and spyware. • Victims included prominent Egyptian journalists with histories of political repression. • The operation is suspected to be linked to the Indian government, indicating state involvement.