Rotten Apple: An Invasive Threat Actor Targeting Civil Society in Lebanon
A Lebanese journalist received a message on their iPhone. It looked exactly like Apple: Account at risk. New device connected. Act now.
The whole thing took 30 seconds, which is less time than it takes to read this paragraph.
Their account had been compromised. When they reached out to our Digital Safety Helpdesk and the case reached our Digital Forensic Lab, our team found that the journalist’s email had been hardcoded into the attack page before they ever clicked anything. This was not a random scam. They were the target, as were other journalists and civil society figures across the region, reached through the same infrastructure, on WhatsApp and iMessage, with Signal and Telegram also in the attackers’ sights.
Working with Access Now, and with independent analysis from Lookout, we linked the campaign to a threat actor believed to be operating across our region. Read the full report.
Collaboration with Miss Lebanon
In times like these, Miss Lebanon 2026 Perla Harb told her followers, everything feels heavy. We are all living through fear and displacement. We are all saying goodbye to people we love, losing homes, losing ground. And on top of all of that our phones keep buzzing. WhatsApp groups, breaking news, videos we cannot verify, links we do not recognise.
This year, Perla Harb partnered with us to share something simple: you do not have to navigate this alone, and you do not have to protect yourself beyond what you can carry.
Here is the advice she shared:
Enable two-factor authentication
Don’t open links you don’t recognise
Go to your WhatsApp settings and make sure only people you know can add you to groups
Check the news before you share it