GoKawiilSecurity researchers say they have identified a hack-for-hire group targeting journalists, activists, and government officials across the Middle East and North Africa. The hackers used phishing attacks to access targets’ iCloud backups and messaging accounts on Signal, and deployed Android spyware capable of taking over the targets’ devices.
This hacking campaign highlights a growing trend of government agencies outsourcing their hacking operations to private hack-for-hire companies. Some governments already rely on commercial companies that develop spyware and exploits used by police and intelligence agencies to access data on people’s phones.
Researchers from the digital rights organization Access Now documented three instances of attacks over 2023 through 2025 against two Egyptian journalists, and a journalist in Lebanon whose case was also documented by digital rights organization SMEX.
Mobile cybersecurity company Lookout also investigated these attacks. The three organizations collaborated with each other and published separate reports on Wednesday.
According to Lookout, the attacks go beyond members of Egyptian and Lebanese civil society, and include targets in the Bahraini and Egyptian governments, as well as targets in the United Arab Emirates, Saudi Arabia, the United Kingdom, and potentially the United States or alumni of American universities.
Lookout concluded that the hackers behind this hacking campaign work for a hack-for-hire vendor that its researchers have codenamed BITTER, which the investigating cybersecurity companies suspect has ties to the Indian government.
Justin Albrecht, principal researcher at Lookout, told TechCrunch that the company behind BITTER may be called Rebsec Solutions, and could be an offshoot of the Indian hack-for-hire startup Appin. In 2022 and 2023, Reuters published extensive investigations into Appin and other similar India-based companies, which exposed how these companies are allegedly hired to hack company executives, politicians, military officials, and others.
Techcrunch event This Week Only: Up to $482 savings for Disrupt 2026 Offer ends April 10, 11:59 p.m. PT
Your next round. Your next hire. Your next breakout opportunity. Find it at TechCrunch Disrupt 2026, where 10,000+ founders, investors, and tech leaders gather for three days of 250+ tactical sessions, powerful introductions, and market-defining innovation. Register now to secure these savings. This Week Only: Up to $482 savings for Disrupt 2026 Offer ends April 10, 11:59 p.m. PT
... continue reading