Security researchers have uncovered a hacking group targeting journalists, activists, and government officials across the Middle East and North Africa. The hackers used phishing attacks and Android spyware to access iCloud backups and messaging accounts, raising concerns over private hack-for-hire companies.

The campaign, which includes targets in Egypt, Lebanon, Bahrain, United Arab Emirates, Saudi Arabia, UK, US or ex-US alumni, points to a growing trend of governments outsourcing their hacking operations. The hackers may be linked to the Indian hack-for-hire vendor Appin and its offshoot RebSec.

The use of cheap, effective techniques like phishing for iCloud access shows how private espionage services can pose a threat to individuals’ privacy and security. For those in the crosshairs, it’s not just about personal data—it's about freedom of expression.

While groups like BITTER may lack advanced tools, their tactics remain highly potent. The ease with which these hackers operate raises questions about accountability and the future of digital privacy.