Unnamed high-profile Lebanese journalist hit by network compromise
Incident
Summary
Hide ▲
Show ▼
An unnamed high-profile Lebanese journalist had an Apple account successfully compromised in 2025, creating unauthorized access to a personal and professional identity surface. The takeover followed phishing lures delivered through Apple Messages and later WhatsApp, and the attacker added a virtual device to the account. The incident matters because it shows a fast account-abuse workflow that could expose private contacts, messages, and linked services.
Related Happenings
Meta AI-powered support tools abused in Instagram account recovery flow
Security Tool/Service
H score26
First: 02.06.2026 18:47
Last: 02.06.2026 18:47
Sources 1
About this happening:
Instagram accounts were hijacked after attackers abused Meta’s AI-powered support tools to pass recovery checks and change the recovery email, creating a direct failure in...
Meta AI-powered support tools abused in Instagram account recovery flow
Security Tool/ServiceAbout this happening: Instagram accounts were hijacked after attackers abused Meta’s AI-powered support tools to pass recovery checks and change the recovery email, creating a direct failure in...
Instagram accounts for Obama White House hit by account takeover attack
Incident
H score40
First: 01.06.2026 20:32
Last: 01.06.2026 20:32
Sources 1
About this happening:
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced after attackers abused Meta’s AI supp...
Instagram accounts for Obama White House hit by account takeover attack
IncidentAbout this happening: The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced after attackers abused Meta’s AI supp...
Google sponsored search ManageWP phishing campaign
Campaign
H score13
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
Suspected Russia-linked Signal phishing campaign targeting political accounts
Campaign
H score18
First: 28.04.2026 13:54
Last: 28.04.2026 13:54
Sources 1
About this happening:
A suspected Russia-linked phishing campaign on Signal compromised about 300 political-sphere accounts, exposing chats, ongoing conversations, and address books. Victim...
Suspected Russia-linked Signal phishing campaign targeting political accounts
CampaignAbout this happening: A suspected Russia-linked phishing campaign on Signal compromised about 300 political-sphere accounts, exposing chats, ongoing conversations, and address books. Victim...
Latest development: 12.05.2026 22:40
Signal introduced new in-app confirmations, warning messages, and educational prompts to help users resist phishing and social engineering attempts, including bogus Signal Support lures and requests to scan QR codes or share registration codes, PINs, or recovery keys.
Apple account change notification phishing campaign
Campaign
H score30
First: 19.04.2026 19:03
Last: 19.04.2026 19:03
Sources 1
About this happening:
A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authen...
Apple account change notification phishing campaign
CampaignAbout this happening: A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authen...
Timeline
-
09.04.2026 13:45 1 articles · 3mo ago
Lebanese journalist detects Apple account compromise
Detection Ioc UpdateOn May 25, 2025, an unnamed high-profile Lebanese journalist contacted SMEX’s Digital Forensics Lab after detecting phishing activity tied to an Apple account compromise, triggering immediate investigation; the account takeover included a virtual device being added to the journalist’s Apple account.
Show sources
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45
-
08.04.2026 03:00 2 articles · 3mo ago
SMEX documents the Lebanese journalist’s Apple account takeover
Initial DisclosureOn April 8, SMEX publicly documents the compromise of an unnamed high-profile Lebanese journalist, noting an initial lure sent through Apple Messages, a follow-on WhatsApp wave two days later, and infrastructure that harvested the victim’s username, password, and 2FA codes while aiming to take over the Apple account.
Show sources
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45
- Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group — www.infosecurity-magazine.com — 09.04.2026 13:45