Egyptian and Lebanese Journalists Targeted by Hack-for-Hire Spyware Operation, Lookout Links Campaign to BITTER APT

On October 18, 2023, Al-A'sar, then in Lebanon, received an iMessage from an account posing as Apple support, instructing him to verify a phone number tied to his account. The message showed the sender already knew the phone number and email address on the account. After repeated attempts, Al-A'sar submitted his credentials. Apple then prompted his trusted devices to approve a new sign-in, and the notification placed that sign-in in Cairo while he was physically in Lebanon. The location mismatch is what stopped the attack.

Access Now records that he refrained from engaging further and sought support.

Days later a second link arrived. Because Al-A'sar was on a call with the Helpline at the time, analysts scanned it live. It resolved to a page requesting his 2FA code, stating that the code had been sent to a number ending in the same two digits as his own. The attacker already held the password and needed only the second factor to complete the earlier sign-in. The domain com-en-uk[.]co had been registered on July 26, 2023, but passive DNS shows the subdomain signin-apple[.]com-en-uk[.]co first resolved on the day of the attack, indicating infrastructure stood up for this specific target.

Eltantawy was hit in the same window, within hours, using near-identical links that differed only in a trailing identifier. A second round followed in January 2024 from a different impersonation account and a different domain. Those URLs were disabled before the Helpline could examine them. Access Now's web summary states that the attackers failed to lure Eltantawy into taking action and did not succeed in compromising either Egyptian target's account.

The timing around Eltantawy is documented in the Access Now report. He had already been targeted with Cytrox's Predator spyware in September 2021 and again between May and September 2023, according to The Citizen Lab, which attributed that earlier operation to the Egyptian government. The first attempt on his Apple account came in October 2023, one month after Citizen Lab published and Apple shipped an update closing the vulnerability Predator had exploited.

Eltantawy was imprisoned in 2024 and barred from standing for election for five years; the International Commission of Jurists called the conviction politically motivated.

In parallel, on January 6, 2024, a LinkedIn profile using the name "Haifa Kareem" approached Al-A'sar with a job offer. He supplied a phone number and email. On January 24 an email from haifakareem657@gmail[.]com sent what appeared to be a Zoom interview link, shortened through rebrand.ly. He did not click it and referred it to the Helpline, which found a Google OAuth 2.0 consent phishing page. Rather than spoof a login screen, this attack asks the user to grant an attacker-controlled application permission to their real Google account.

The resulting token would have persisted until the victim revoked app access or changed the password. Shared hosting and a common JARM hash tied this infrastructure back to the October 2023 Apple attacks.

The Lebanese case ran in May 2025. SMEX documented a first attack on May 19, 2025 via Apple Messages that compromised the journalist's Apple account and resulted in a virtual device being attached to it. A second wave on May 21 and 22, delivered over WhatsApp, failed, but SMEX captured a complete exfiltration of username, password and 2FA codes and timed the takeover window at roughly 30 seconds. Access Now assesses the same actor is likely behind all three cases based on shared impersonation tactics, a common fingerprint and reused infrastructure.

The attribution here has three distinct layers and they should not be collapsed. Access Now's forensic report describes "a likely Advanced Persistent Threat" and reports that Lookout "independently assesses that the campaigns against these two individuals may be linked to a hack-for-hire threat group with ties to Asia." Access Now does not name a group anywhere in its report. Its web summary adds that there is not enough information to confidently conclude which government or governments may be behind the attacks.

Lookout's companion report, published the same day and linked from the Access Now report, goes further. " SMEX records the aliases as BITTER, APT-C-08 and T-APT-17.

Lookout's evidentiary chain runs through infrastructure, not code alone. The ProSpy distribution domain com-ae[.]net was linked to BITTER by the open-source Maltrail project, citing a FOFA fingerprint query built on JARM hash, page title, ASN and response length.

That query connects it to youtubepremiumapp[.]com, a 2022 command-and-control domain for the Dracarys Android malware that Meta attributed to BITTER in 2022. Lookout then found structural similarities between the Dracarys and ProSpy codebases despite different languages: parallel worker-class naming, numbered C2 command sets, and endpoint prefixes of "r3" versus "v3". Lookout notes BITTER is assessed as having suspected ties to the Indian government, citing research by Proofpoint and Threatray.

Lookout is equally clear about what does not fit. " That mismatch is precisely why Lookout reads the operation as contract work rather than direct BITTER tasking, pointing to prior overlap between BITTER's BitterDawn malware and the known hack-for-hire actor Bahamut, and to Rebsec, an Indian corporate espionage firm staffed by former Appin and Belltrox personnel that Google documented in 2022 targeting Saudi Arabia, Bahrain and the UAE with similar phishing domains.

• Confirmed compromise, Lebanon: Apple account credentials and two-factor authentication codes for a high-profile Lebanese journalist, with a virtual device added to the account. An Apple account compromise of this kind reaches iCloud backups, contacts, stored files and device sync.
• Attempted, Egypt: Al-A'sar's Apple password was submitted to a phishing page but the sign-in was not completed. No successful compromise of either Egyptian target's account is reported.
• ProSpy spyware capability, where installed: document, image, audio, video, archive and backup files, recently modified files, SMS messages, phone contacts, and device hardware and software information.
• Second-order exposure: Access Now states that a successful compromise would have exposed the targets' families, associates, colleagues and journalistic sources to persecution. For exiled journalists this is the operative harm, and it does not require the primary target to remain in-country.