Hackers Targeting Human Rights Activists in Morocco and Western Sahara

Cisco Talos identifies a targeted campaign by a cluster called Starry Addax that leverages spear-phishing to trick Sahrawi human-rights activists into installing a fake Sahara Press Service Android app (FlexStarling) or to visit credential-harvesting login pages; the campaign uses bespoke infrastructure (e.g., ondroid.site, ondroid.store), requests extensive device permissions, and employs a Firebase-based C2, indicating a stealthy, high-value targeting operation active since January 2024.