BITTER APT Uses Signal, Google, and Zoom Lures to Spread ProSpy Spyware

Researchers from Access Now and Lookout uncovered a multi-year (2022–2025) targeted espionage campaign against journalists and opposition politicians in the Middle East that leverages spearphishing (LinkedIn, iMessage), fake login pages and malicious Signal QR codes to deliver Android spyware (ProSpy/ToSpy). The spyware, developed in Kotlin and actively evolving, can exfiltrate photos, audio, video, SMS, contacts and documents; Lookout links the tooling and command structure to the South Asian APT known as BITTER, and investigators suspect the operation may have been conducted as hack-for-hire.