Spearphishing Campaign Targets Egyptian Journalists in Coordinated Cyber Operation

April 08, 2026 – Egypt –

Two Egyptian journalists have been targeted in a sophisticated spearphishing campaign designed to compromise their personal and professional digital accounts, raising renewed concerns about the use of cyber tools to monitor and intimidate members of the press.

According to findings by digital rights organizations, the attacks focused on prominent journalist Mostafa Al-A’sar and political figure and journalist Ahmed Tantawy. The campaign relied on carefully crafted messages that impersonated trusted contacts or legitimate services in an attempt to deceive the targets into revealing sensitive information, including login credentials and financial data.

Researchers determined that the operation took place over an extended period between 2023 and 2024 and demonstrated a high level of precision. The attackers appeared to possess detailed knowledge of their targets, enabling them to tailor messages that increased the likelihood of success.

Technical analysis conducted by cybersecurity experts linked the activity to a “hack-for-hire” model, in which third-party actors are contracted to carry out surveillance or intrusion operations. Investigators identified similarities in infrastructure and tactics across multiple incidents, suggesting that the same group may have been responsible for targeting not only the Egyptian journalists but also others in the region.

The phishing attempts aimed to infiltrate widely used platforms, including Apple, Microsoft, and Google accounts, potentially granting attackers access to communications, contacts, and stored data. Experts warn that such breaches can expose confidential sources and undermine journalists’ ability to operate securely.

While definitive attribution remains unclear, analysts noted indicators that could point toward state-linked involvement, given the profile of the targets and the resources required to conduct sustained operations of this nature. However, researchers emphasized that conclusive evidence tying the campaign to a specific government has not been established.

Press freedom advocates have condemned the attacks, describing them as part of a broader pattern of digital repression against journalists and critics. They caution that cyber surveillance tactics, including phishing, are increasingly being used as alternatives or complements to spyware, allowing perpetrators to obscure accountability.

The case highlights the growing risks faced by journalists in the digital sphere, where targeted cyberattacks can have far-reaching consequences for both personal safety and the integrity of investigative reporting.

Reference –

https://therecord.media/two-egyptian-journalists-targeted-spearphishing-campaign