New research reveals a targeted attack against Egyptian journalists, highlighting the ongoing threat of hack-for-hire operations against civil society. The campaign, uncovered by digital rights non-profit **Access Now** in collaboration with mobile security company **Lookout**, demonstrates the lengths to which malicious actors will go to silence dissent. ### Spearphishing Campaign Details The report details how, between October 2023 and January 2024, the attackers impersonated legitimate people and services to target the victims' **Apple** and **Google** accounts. The investigation suggests the infrastructure used could enable the deployment of **Android** spyware, granting access to files, contacts, messages, geolocation data, and even device microphones and cameras. "Our investigation showed that there is a persistent infrastructure for attacks; we found overlapping domains, hosting, and similarities in code," the report stated. The attackers utilized fake personas and masqueraded as legitimate services, including **Signal**, to deploy malware. ### Victims and Their Backgrounds Neither of the targeted accounts were successfully penetrated. One victim, after entering account credentials in response to a message seemingly from **Apple**, became suspicious upon receiving a two-factor authentication notification from an unexpected location and ceased engagement. The victims, **Mostafa Al-A’sar** and **Ahmed Eltantawy**, are both known for their critical coverage of the Egyptian government. **Al-A’sar**, a journalist and human rights defender, previously spent four years in an Egyptian prison before fleeing the country. **Eltantawy**, a former member of Parliament, had planned to run against Egyptian President Abdel Fattah al-Sisi before facing arrests of supporters and relatives, and ultimately being jailed himself. **Citizen Lab** previously reported that **Eltantawy's** phone was targeted with **Intellexa’s Predator** spyware in 2021 and 2023. ### The Bigger Picture "This hack-for-hire campaign exposes yet another weapon in the arsenal of malicious actors determined to crush dissent and silence truth-tellers in the region," said **Marwa Fatafta**, a director at **Access Now**. The organization urges journalists in the Middle East and North Africa to exercise caution and strengthen their digital security practices. [](https://www.recordedfuture.com/platform?mtm_campaign=ad-unit-record)