Security researchers say they have identified a hack-for-hire group targeting journalists, activists, and government officials across the Middle East and North Africa. The hackers used phishing attacks to access targets\u2019 iCloud backups and messaging accounts on Signal, and deployed Android spyware capable of taking over the targets\u2019 devices.<\/p>\n\n
This hacking campaign highlights a growing trend of government agencies outsourcing their hacking operations to private hack-for-hire companies. Some governments already rely on commercial companies that develop spyware and exploits used by police and intelligence agencies to access data on people’s phones.<\/p>\n\n
Researchers from the digital rights organization Access Now documented three instances of attacks<\/a> over 2023 through 2025 against two Egyptian journalists, and a journalist in Lebanon whose case was also documented<\/a> by digital rights organization SMEX. <\/p>\n\n Mobile cybersecurity company Lookout also investigated these attacks<\/a>. The three organizations collaborated with each other and published separate reports on Wednesday. <\/p>\n\n According to Lookout, the attacks go beyond members of Egyptian and Lebanese civil society, and include targets in the Bahraini and Egyptian governments, as well as targets in the United Arab Emirates, Saudi Arabia, the United Kingdom, and potentially the United States or alumni of American universities. <\/p>\n\n Lookout concluded that the hackers behind this espionage campaign work for a hack-for-hire vendor with connections to BITTER APT, a hacking group that cybersecurity<\/a> companies<\/a> suspect has ties to the Indian government.<\/p>\n\n Justin Albrecht, principal researcher at Lookout, told TechCrunch that the company behind the campaign may be an offshoot of the Indian hack-for-hire startup Appin, and noted one such company named RebSec<\/a> as a possible suspect. In 2022 and 2023, Reuters published extensive<\/a> investigations<\/a> into Appin and other similar India-based companies, which exposed how these companies are allegedly hired to hack company executives, politicians, military officials, and others.\u00a0<\/p>\n