Hack‑for‑Hire Cyber Campaign Targets Journalists Across Middle East and North Africa

April 09, 2026 – MEA –

A coordinated hack‑for‑hire campaign has been revealed targeting journalists in the Middle East and North Africa (MENA), underscoring growing digital threats faced by independent media workers in the region. Investigations by digital rights group Access Now and cybersecurity partners document sustained spear‑phishing and spyware efforts aimed at compromising critical online accounts and personal devices belonging to journalists and government critics.

According to the Access Now report, two prominent Egyptian journalists — Mostafa Al‑A’sar, a well‑known critic of Egyptian authorities, and Ahmed Tantawy, a journalist and politician — were repeatedly targeted with tailored messages designed to trick them into revealing login credentials and financial information. The campaign used advanced impersonation techniques and messages crafted to resemble trusted contacts or services, indicative of a deliberate and informed threat approach.

Both journalists had previously faced politically motivated pressures, and one had been the target of spyware in earlier incidents, highlighting a pattern of digital repression extending beyond traditional legal and physical intimidation. Access Now’s forensic analysis, conducted with mobile security firm Lookout, suggests that the campaigns were likely orchestrated by a third‑party hacking group operating on a hack‑for‑hire model linked to a South Asia‑focused cyber espionage actor, though definitive attribution to any state remains unconfirmed.

The same threat actor appears to have conducted similar operations against a Lebanese journalist, according to additional reporting. The recurrence of comparable tactics and overlapping attack infrastructure across these cases strengthens concerns that these operations form part of a broader digital offensive against critical voices in the region.

The Committee to Protect Journalists (CPJ) condemned the targeting of Egyptian and Lebanese journalists, emphasising that cyberattacks not only jeopardise personal safety but also threaten confidential sources and the ability to conduct independent reporting. CPJ representatives noted that hacking and surveillance often act as precursors to further harassment or legal action, creating a chilling effect on press freedom.

Experts warn that spear‑phishing and outsourced cyber intrusion services allow governments or powerful actors to evade accountability, especially as regulatory oversight on commercial spyware tightens. These operations can offer cheaper, less traceable alternatives to traditional spyware, complicating efforts to identify perpetrators and protect potential targets.

The campaign’s exposure has prompted calls for enhanced digital security practices among journalists and stronger safeguards against both government and non‑state cyber threats. As digital attacks evolve, press freedom advocates stress that protecting journalists in cyberspace is essential to maintaining open and transparent public discourse in the MENA region.

Reference –

https://www.accessnow.org/mena-phishing-2026/

Hack-for-hire spyware campaign targets journalists in Middle East, North Africa

Egyptian, Lebanese journalists targeted in cyber attacks