Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region

A hack-for-hire campaign linked to the threat actor Bitter targeted journalists, activists, and government officials across the MENA region using spear-phishing and Android spyware.

• •Egyptian journalists Mostafa Al-A'sar and Ahmed Eltantawy were targeted via spear-phishing attacks on their Apple and Google accounts in 2023–2024, using fake login pages and OAuth 2.0 consent phishing.
• •A Lebanese journalist's Apple Account was fully compromised in May 2025 via phishing through iMessage and WhatsApp impersonating Apple Support, with a virtual device added for persistent access.
• •Phishing infrastructure using domains like 'com-ae[.]net' overlaps with an Android spyware campaign deploying ProSpy and ToSpy, which exfiltrate contacts, SMS, device metadata, and local files.
• •ProSpy shares structural similarities with Bitter's earlier Dracarys malware, including worker class naming conventions and numbered C2 commands, despite being rewritten in Kotlin.