Middle East Civil Society Figures Targeted in Sophisticated Spear-Phishing Campaign In August 2025, digital rights organization Access Now uncovered a spear-phishing campaign targeting high-profile civil society figures in the Middle East, including three prominent journalists in Egypt and Lebanon. The campaign, active from 2023 to 2024, was linked to the Bitter APT group, a suspected South Asian cyber espionage threat actor active since at least 2013. The targets included Egyptian journalists Mostafa Al-A’sar and Ahmed Eltantawy, both vocal critics of the government with histories of political imprisonment. A third, unnamed Lebanese journalist was also identified by Beirut-based digital rights group SMEX as a victim in 2025. The attackers employed Android malware, delivered through fake accounts and impersonation tactics across platforms, including Signal. Security firm Lookout analyzed the infrastructure and attributed the campaign to a hack-for-hire operation with ties to Bitter, which has previously targeted governments and energy sectors in Pakistan, China, Bangladesh, and Saudi Arabia. Further investigation revealed the malware strains ProSpy and ToSpy disguised as messaging apps were also used in a separate campaign against users in the United Arab Emirates (UAE), as documented by ESET in October 2025. The attackers invested significant effort in social engineering, mimicking legitimate services to gain trust before deploying the spyware. The campaign highlights the persistent threat posed by state-aligned cyber espionage groups to journalists, activists, and civil society in the region.