Hack-for-hire group caught targeting Android devices and iCloud backups

Recent findings by cybersecurity experts reveal a disturbing trend in the Middle East and North Africa, where a hack-for-hire syndicate has been actively targeting journalists, activists, and government officials. Employing phishing tactics, these hackers have gained unauthorized access to victims’ iCloud backups and messaging applications, including Signal. They are also utilizing Android spyware capable of compromising devices completely. This alarming campaign underscores the increasing reliance of government entities on private hacking firms to conduct operations that may otherwise be deemed unethical. Reports indicate that several governments are already utilizing commercial spyware and exploits developed by private companies to infiltrate personal data on individuals’ mobile devices. Researchers from Access Now have meticulously documented three separate attacks occurring between 2023 and 2025, focusing on two journalists from Egypt and another in Lebanon, whose case has also been highlighted by the digital rights organization SMEX. Collaborating with cybersecurity firm Lookout, these organizations published their findings on Wednesday, revealing that the scope of the attacks extends beyond civil society members in Egypt and Lebanon to include targets in Bahrain, the United Arab Emirates, Saudi Arabia, the United Kingdom, and possibly even the United States. Investigators have identified the hacker group behind these operations as BITTER, which is believed to be associated with an Indian hack-for-hire company known as RebSec Solutions. Justin Albrecht, a principal researcher at Lookout, suggested that this firm could be an offshoot of the now-defunct Appin, which was scrutinized in previous investigations by Reuters for its alleged role in hacking high-profile individuals. Albrecht pointed out that while Appin has seemingly disappeared, the emergence of BITTER indicates that these nefarious activities have simply transitioned to smaller firms. This strategic shift allows such groups to provide plausible deniability to their clients, who often find these hack-for-hire services more affordable than purchasing commercial spyware. While attempts to reach RebSec Solutions for comments were unsuccessful, as the company has erased its online presence, experts continue to express concern over the tactics employed by hackers. Mohammed Al-Maskati from Access Now’s Digital Security Helpline noted that the ease of evading accountability complicates the situation. The methods used by BITTER are less sophisticated than those of other hacking groups, yet they remain effective. For instance, hackers targeting iPhone users often resorted to deceiving victims into divulging their Apple ID details, granting them access to iCloud backups and, ultimately, the contents of the target’s devices. This approach may serve as a cost-effective alternative to more advanced iOS spyware. In their attempts to compromise Android users, the hackers deployed a spyware named ProSpy, disguised as widely used messaging applications such as Signal, WhatsApp, and Zoom, as well as regional favorites like ToTok and Botim. Some victims were misled into adding a new device, controlled by the hackers, to their Signal accounts, a tactic that has gained traction among various cybercriminal factions, including Russian operatives. As the investigation unfolds, the implications of such hack-for-hire operations continue to raise alarms regarding privacy and security on a global scale.