BITTER APT Uses Signal, Google, and Zoom Lures to Spread ProSpy Spyware

BITTER APT spreads ProSpy and ToSpy via Signal, Google, and Zoom lures, targeting journalists through LinkedIn and iMessage spearphishing.

An ongoing spying operation has been discovered, specifically targeting journalists and opposition politicians across the Middle East. Researchers from the digital rights group Access Now and the security firm Lookout collaborated in August 2025 to track these attacks. Their work shows that hackers have been active from at least 2022 until today.

How the scam works

According to Lookout, the scam involves a trick called spearphishing, in which a scammer sends a believable message to their targeted person to make them click a link. Researchers found that some targets were sent messages on LinkedIn or through iMessage, and some pretended to be from Apple Support.

If the target clicks the link, they are sent to a “simple, single page” fake website. It looks like real login pages for various common use ...