The Eye on the Nile

Phishing attack on government opponents in Egypt - with apps from the Play Store

Specialists reveal a sophisticated phishing attack in Egypt. Android apps that made it into the Play Store without catching the eye were involved.

Back in March 2019, Amnesty International published a report that uncovered a targeted attack against journalists and human rights activists in Egypt. The victims even received an e-mail from Google warning them that government-backed attackers attempted to steal their passwords. https://www.amnesty.org/en/latest/research/2019/03/phishing-attacks-using-third-party-applications-against-egyptian-civil-society-organizations/

According to the report, the attackers did not rely on traditional phishing methods or credential-stealing payloads, but rather utilized a stealthier and more efficient way of accessing the victims’ inboxes: a technique known as “OAuth Phishing”. By abusing third-party applications for popular mailing services such as Gmail or Outlook, the attackers manipulated victims into granting them full access to their e-mails.

Recently, we were able to find previously unknown or undisclosed malicious artifacts belonging to this operation. A new website we attributed to this malicious activity revealed that the attackers are going after their prey in more than one way, and might even be hiding in plain sight: developing mobile applications to monitor their targets, and hosting them on Google’s official Play Store.

After we notified Google about the involved applications, they quickly took them off of the Play Store and banned the associated developer.

👉🏼 Read more:
https://research.checkpoint.com/the-eye-on-the-nile/

#Egypt #pishing #attacks #research #android #apps #playstore
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

#Egypt's puppet dictator getting his third booster shot. Way to lead by example there buddy!

He didn't even trust a fake syringe, just in case

Egypt buys half a million tonnes of wheat from India:

[IAF: This purchase was pending before India announced their ban — will be interesting to see price point.]

Egypt has four months' worth of strategic at reserves and six months of vegetable oils, the country's prime minister said earlier in the day.

Egypt, one of the world's biggest wheat importers, is looking for alternatives to Black Sea grain exports which face disruptions caused by Russia's invasion of Ukraine, both major wheat exporters to Egypt.

#Egypt #wheat

https://www.reuters.com/world/middle-east/egypt-agrees-buy-half-mln-tonnes-indian-wheat-supply-minister-2022-05-15/

Stealth Soldier Backdoor Used in Targeted Espionage Attacks in North Africa - Check Point Research – June 2023

Check Point Research observed a wave of highly-targeted espionage attacks in Libya that utilize a new custom modular backdoor.
Stealth Soldier malware is an undocumented backdoor that primarily operates surveillance functions such as file exfiltration, screen and microphone recording, keystroke logging and stealing browser information.

The Stealth Soldier infrastructure has some overlaps with infrastructure the The Eye on the Nile which operated against Egyptian civilian society in 2019. This is the first possible re-appearance of this threat actor since then.

Phishing attacks using third-party applications against Egyptian civil society organizations - Amnesty International – 2019

#StealthSoldier #EyeOnTheNile
#Backdoor #espionage #malware #Egypt #Libya

PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions | The Citizen Lab –

Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp. The targeting took place after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections.

In August and September 2023, Eltantawy’s Vodafone Egypt mobile connection was persistently selected for targeting via network injection; when Eltantawy visited certain websites not using HTTPS, a device installed at the border of Vodafone Egypt’s network automatically redirected him to a malicious website to infect his phone with Cytrox’s Predator spyware.


#Predator #Cytrox #Egypt

🇪🇬🇮🇱🇵🇸 Footage of Egyptian trucks delivering humanitarian aid to the Gaza Strip has emerged. A total of 20 units of equipment are expected to be delivered. However, based on this video, it appears that the volumes may be one and a half to two times larger than those of regular trucks.
#Egypt #Israel #Palestine

To support us, click here. Original msg

🇵🇸 Israel’s long-held plan to drive Gaza’s people into Sinai is now within reach – Declassified UK - Jonathan Cook

Behind the scenes, Israeli officials term their latest ethnic cleansing proposal a “Greater Gaza Plan”. Details first leaked in the Israeli media in 2014, although reports indicate that the origins date to 2007, when the Bush administration was apparently brought on board following Hamas’ election victory in Gaza a year earlier.

At the time, Israel’s secret plan relied on carrots more than sticks. The idea was to attach Gaza to Sinai, erasing the border between the two. Washington would help secure international funding for a free trade zone in Sinai.

#Palestine #Gaza #Deportation #WarCrimes #Genocide #EthnicCleansing #US #Israel #Egypt #Sinai
27/10/2023

🇪🇬🇯🇴🇵🇸 The Egyptian parliament met on October 19 and gave President Abdel Fattah Al-Sisi the power to declare war against Israel, if necessary. Egypt and Israel have a peace treaty dating from 1979, which has been a success, proving that a neighboring Arab and Muslim country can share long-lasting peaceful relations with the Jewish State of Israel.

Egyptians have watched in horror at the scenes of death and destruction in Gaza as the Israeli government exacts its revenge on Hamas after the October 7 attack on Israel. With the promised Israeli ground invasion of Gaza beginning at any moment, it is expected to be a bloodbath among unarmed civilians.

The U.S. has no friends, only interests. America is the first to teach the lesson: “Treaties are made to be broken.”

💬 Read more by Steven Sahiounie

#diplomacy #Egypt #Israel #Jordan #MiddleEast #Palestine

🔻More analysis here 🔻Subscribe 🔻Join us on VK

🇵🇸 The Gaza refugees stranded in Egypt | Mondoweiss –

Many Palestinians have been stranded in Egypt since the start of the war and suffer from poverty as they struggle to contact their loved ones. "Whenever I watch TV, I die a hundred times a day," says Amnah Alshimbari, whose family remains in Gaza.

The following are stories from some of the many Palestinians who were able to cross into Egypt during or before Israel’s genocidal war on Gaza.

Article & Photos by Mohammed Salem
#Palestine #Egypt #Gaza #Refugees #Testimonies
12/01/2024

#Egypt and israel DON'T want you to know about this plan, it's TERRIFYING
@VanessaBeeley at Redacted News
https://www.youtube.com/watch?v=y5S1s-V_dNc

Researchers spot new infrastructure likely used for Predator spyware

"New research from Recorded Future’s Insikt Group examines newly discovered infrastructure related to the operators of Predator, a mercenary mobile spyware. This infrastructure is believed to be in use in at least eleven countries, including #Angola, #Armenia, #Botswana, #Egypt, #Indonesia, #Kazakhstan, #Mongolia, #Oman, the Philippines, Saudi Arabia (#KSA), and #Trinidad and #Tobago.

Notably, this is the first identification of Predator customers in #Botswana and the #Philippines. Despite being marketed for counterterrorism and law enforcement, Predator is often used against civil society, targeting journalists, politicians, and activists, with no specific victims or targets currently identified in this latest activity."

#Predator #Cytrox #Intellexa

Arid Viper poisons Android apps with AridSpy | WeLiveSecurity

ESET researchers have identified five campaigns targeting Android users with trojanized apps. Most probably carried out by the Arid Viper APT group, these campaigns started in 2022 and three of them are still ongoing at the time of the publication of this blogpost. They deploy multistage Android spyware, which we named AridSpy, that downloads first- and second-stage payloads from its C&C server to assist it avoiding detection.

The malware is distributed through dedicated websites impersonating various messaging apps, a job opportunity app, and a Palestinian Civil Registry app. Often these are existing applications that had been trojanized by the addition of AridSpy’s malicious code.

Via @androidmalware
#Palestine #Egypt #AridSpy #Android
#Trojan #AridViper #APT