Unnamed high-profile Lebanese journalist hit by network compromise
Incident
Summary
Hide ▲
Show ▼
An unnamed high-profile Lebanese journalist had an Apple account successfully compromised in 2025, creating unauthorized access to a personal and professional identity surface. The takeover followed phishing lures delivered through Apple Messages and later WhatsApp, and the attacker added a virtual device to the account. The incident matters because it shows a fast account-abuse workflow that could expose private contacts, messages, and linked services.
Related Happenings
Google sponsored search ManageWP phishing campaign
Campaign
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
Suspected Russia-linked Signal phishing campaign targeting political accounts
Campaign
First: 28.04.2026 13:54
Last: 28.04.2026 13:54
Sources 1
About this happening:
A **suspected Russia-linked** phishing campaign on **Signal** compromised about **300 political-sphere accounts**, exposing chats, ongoing conversations, and address books. Victim...
Suspected Russia-linked Signal phishing campaign targeting political accounts
CampaignAbout this happening: A **suspected Russia-linked** phishing campaign on **Signal** compromised about **300 political-sphere accounts**, exposing chats, ongoing conversations, and address books. Victim...
Latest development: 12.05.2026 22:40
Signal introduced new in-app confirmations, warning messages, and educational prompts to help users resist phishing and social engineering attempts, including bogus Signal Support lures and requests to scan QR codes or share registration codes, PINs, or recovery keys.
Apple account change notification phishing campaign
Campaign
First: 19.04.2026 19:03
Last: 19.04.2026 19:03
Sources 1
About this happening:
A **callback phishing campaign** is abusing **Apple account change notifications** to deliver fake **iPhone purchase** scams through legitimate emails, making the lure look authen...
Apple account change notification phishing campaign
CampaignAbout this happening: A **callback phishing campaign** is abusing **Apple account change notifications** to deliver fake **iPhone purchase** scams through legitimate emails, making the lure look authen...
Malicious actor campaign expands across multiple victims
Campaign
First: 14.04.2026 19:37
Last: 14.04.2026 19:37
Sources 1
About this happening:
A **fake Ledger Live app** in **Apple’s App Store** drained about **$9.5 million** in cryptocurrency from **50 victims** in a few days, indicating a broader **wallet-theft campaig...
Malicious actor campaign expands across multiple victims
CampaignAbout this happening: A **fake Ledger Live app** in **Apple’s App Store** drained about **$9.5 million** in cryptocurrency from **50 victims** in a few days, indicating a broader **wallet-theft campaig...
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
How related:
Several civil society figures in Middle Eastern countries, including three high-profile journalists in Egypt and Lebanon, have been targeted by a spear-phishing campaign likely tied to a known South Asian cyber espionage group.
About this happening:
A **spear-phishing campaign** targeted **civil society figures in Middle Eastern countries**, including **three journalists in Egypt and Lebanon**, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignHow related: Several civil society figures in Middle Eastern countries, including three high-profile journalists in Egypt and Lebanon, have been targeted by a spear-phishing campaign likely tied to a known South Asian cyber espionage group.
About this happening: A **spear-phishing campaign** targeted **civil society figures in Middle Eastern countries**, including **three journalists in Egypt and Lebanon**, creating account-compromise ris...
Timeline
-
09.04.2026 13:45 1 articles · 1mo ago
Lebanese journalist detects Apple account compromise
Detection Ioc UpdateOn May 25, 2025, an unnamed high-profile Lebanese journalist contacted SMEX’s Digital Forensics Lab after detecting phishing activity tied to an Apple account compromise, triggering immediate investigation; the account takeover included a virtual device being added to the journalist’s Apple account.
Show sources
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45
-
08.04.2026 03:00 2 articles · 1mo ago
SMEX documents the Lebanese journalist’s Apple account takeover
Initial DisclosureOn April 8, SMEX publicly documents the compromise of an unnamed high-profile Lebanese journalist, noting an initial lure sent through Apple Messages, a follow-on WhatsApp wave two days later, and infrastructure that harvested the victim’s username, password, and 2FA codes while aiming to take over the Apple account.
Show sources
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45