Hack-for-Hire Campaign Targets Journalists Across MENA and Egypt

Researchers have uncovered a sophisticated spearphishing operation aimed at journalists and human rights defenders, leveraging custom spyware to exfiltrate private iCloud backups and Android device data.

CAIRO — A new wave of targeted cyberattacks has been identified across the Middle East and North Africa (MENA), specifically focusing on members of the press in Egypt and Lebanon. Investigative reports from digital rights groups, including Access Now and the Citizen Lab, indicate that these attacks are part of a coordinated "hack-for-hire" campaign designed to silence dissent and monitor investigative reporting.

The campaign utilizes highly personalized spearphishing messages delivered via WhatsApp and encrypted chat apps. These messages often masquerade as legitimate security alerts or urgent professional inquiries, tricking victims into clicking malicious links. Once engaged, the attackers use a variety of technical methods — including session hijacking and malicious Android applications — to gain access to the victims' most sensitive information, including private messages, contacts, and cloud-hosted backups.

The technical evolution of "Hack-for-Hire"

Unlike state-sponsored Advanced Persistent Threats (APTs) that develop in-house exploits, hack-for-hire groups operate as private mercenaries. This campaign shows a refined focus on cloud exfiltration. Rather than trying to maintain a persistent presence on a hardened device, the attackers prioritize stealing session tokens or credentials to download entire iCloud or Google Drive backups. This "snapshot" approach allows them to gather months of data in seconds, often before the victim realizes their account has been accessed.

On the Android side, the campaign has been linked to the "Bitter" APT group, which has a history of using mobile malware to monitor geographic locations and record ambient audio. The attackers tailor their malware to bypass common mobile security suites, often packaging the malicious code within seemingly benign tools or PDF readers shared through direct messages.

Targeted spearphishing: The human element

The success of this campaign rests on the high quality of the spearphishing content. In one documented case, an Egyptian journalist was targeted with a message that appeared to come from a well-known international news agency, containing a "briefing document" that was actually a lure for a credential-harvesting site.

This human-centric approach makes technical defenses alone insufficient. Because the attackers spend time researching their targets' professional networks, the lures are highly convincing and designed to exploit the "urgent" nature of news reporting.

The CyberSignal analysis

Signal 01 — The Commercialization of Surveillance

The rise of hack-for-hire groups means that sophisticated surveillance is no longer restricted to superpowers. Medium-sized governments or even wealthy private entities can now buy high-end digital "hit squads." For organizations, this means the threat profile is no longer just "who would want to hack us?" but "who could pay to have us hacked?"

Signal 02 — Cloud Backups as the Primary Target

The shift from device-level spyware to cloud-backup theft is a critical tactical change. It is often easier to steal an iCloud token than it is to achieve a zero-click exploit on an iPhone. Defenders must prioritize "Cloud Security Posture" for individual users, ensuring that backups are either end-to-end encrypted or protected by hardware-based MFA.

Signal 03 — The Weaponization of Trusted Platforms

By using WhatsApp and other encrypted apps to deliver spearphishing links, attackers exploit the "halo of trust" associated with these platforms. Users often feel safer clicking a link in a private chat than in an email. This highlights a need for better "in-app" link scanning and sandboxing within mobile communication tools.

What to do this week

1. Enable Advanced Data Protection. For staff using iPhones, mandate the activation of Apple’s "Advanced Data Protection," which provides end-to-end encryption for iCloud backups, making stolen data unreadable to attackers.
2. Audit Mobile Device Apps. Conduct a "digital spring cleaning" for high-risk users. Remove any unused apps and ensure that all installed applications were sourced directly from the official Google Play or Apple App Store.
3. Conduct "Urgency" Training. Train high-risk personnel to recognize "urgency-based" social engineering. If a message requires immediate action or a link click to view a document, it should be verified through a secondary, out-of-band communication channel.

Sources