Hackers Impersonate Secure Messaging Apps to Deploy ProSpy in Middle East Espionage Attacks

**Executive summary:** A covert mobile espionage campaign dating back to at least 2022 uses fake versions of trusted messaging apps to distribute ProSpy Android spyware via spearphishing and trojanized APKs; the malware harvests contacts, SMS, media, documents and communicates with attacker-controlled C2 servers. Lookout links the operation with moderate confidence to a hack-for-hire actor tied to BITTER APT and documents targeting of journalists, activists, and civil society across multiple countries in the Middle East and beyond.