The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Political Organization
Breach intelligence, attack campaigns, and threat reports targeting the Political Organization sector.
Explore Other Sectors
Political Organization Threat Reports
Iran's Handala Hack Weaponizes Telegram for Sophisticated Surveillance Operations
The Iran-linked threat actor Handala Hack, operating under Iran's Ministry of Intelligence and Security (MOIS), has been attributed to a sophisticated Telegram-based surveillance campaign using the HEAVYGRAM backdoor and CRUDEEXCLUDE utility. Active since September 2023, this operation targets Iranian dissidents, journalists, and opposition groups through social engineering on messaging platforms like Telegram, WhatsApp, and Instagram. The malware masquerades as legitimate applications and establishes persistent command-and-control channels via Telegram, enabling comprehensive surveillance including file exfiltration, screenshot capture, microphone activation, and credential theft. This incident highlights the growing trend of state-sponsored actors leveraging popular messaging platforms for covert operations, demonstrating how encrypted communication channels can be weaponized for intelligence collection while evading traditional detection methods.
6 days ago
Kill Chain
Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal
In 2024, Serbian government authorities conducted systematic surveillance operations against student activists and political opposition using Pegasus and NoviSpy spyware. The SHARE Foundation, in collaboration with Amnesty International and The Citizen Lab, discovered infections on activists' phones, with evidence linking NoviSpy deployments directly to Serbian state authorities. The campaign targeted individuals ahead of elections, representing a coordinated effort to suppress political dissent through digital surveillance. This surveillance operation has prompted 29 European Parliament members to demand delays in Serbia's EU accession process until a full investigation is completed and rule-of-law accountability is established. This incident exemplifies the growing trend of nation-state actors weaponizing commercial spyware against civil society, particularly in countries seeking international legitimacy while simultaneously suppressing domestic opposition through sophisticated surveillance technologies.
2 weeks ago
Kill Chain
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
In December 2025 through January 2026, NSO Group's Pegasus spyware infected the iPhone of a Serbian student protest movement member using a zero-click iMessage exploit. The attack was part of a broader surveillance campaign targeting at least 14 Serbian activists, opposition politicians, and student leaders coinciding with March 2026 local elections. Citizen Lab and SHARE Foundation confirmed the infection, while a separate incident involved NoviSpy Android malware deployed during police detention of another student activist. This incident highlights the escalating use of commercial spyware against civil society, particularly as authoritarian governments increasingly weaponize surveillance technology to suppress political dissent and monitor opposition movements ahead of critical elections.
3 weeks ago
Kill Chain
Serbian Activists Targeted in Largest Documented Pegasus and NoviSpy Spyware Campaign
In early 2026, researchers discovered the first confirmed Pegasus spyware infection of the year alongside NoviSpy variant infections targeting 14 Serbian individuals, including student activists, a parliament member, and local government official. The SHARE Foundation documented this as the largest wave of surveillance in Serbia to date, coinciding with local elections and student protests following the 2024 Novi Sad railway station collapse. Pegasus infections utilized zero-click exploits from December 2025 to January 2026, while NoviSpy variants were deployed during police detention and questioning of activists. This incident highlights the continued weaponization of commercial spyware against civil society and democratic movements, demonstrating how state-sponsored surveillance capabilities are increasingly deployed to suppress political dissent and monitor opposition activities during critical electoral periods.
3 weeks ago
Kill Chain
Russian Actors Exploit ChatGPT for Sophisticated Influence Operation
In August 2026, OpenAI disrupted a Russian-linked influence operation that used ChatGPT accounts with VPNs to bypass geographic restrictions and generate social media content across multiple platforms. The operation promoted the International Burke Institute (IBI), a fake think tank registered in February 2025, which featured copied academic work, false attributions, and a sovereignty index designed to cast Russia favorably. While the campaign reached relatively small audiences of 10-20,000 followers per channel, it demonstrated sophisticated infrastructure building for long-term influence operations. This incident highlights the emerging threat of AI-powered disinformation campaigns that leverage large language models to create credible-appearing institutions and content at scale, representing a new frontier in state-sponsored information warfare.
4 weeks ago
Kill Chain
Apple Issues Warnings on Mercenary Spyware Threats in 110 Countries
In August 2026, Apple issued threat notifications to users in 110 countries, alerting them to potential targeting by mercenary spyware attacks. These sophisticated attacks are designed to remotely compromise iPhones, often focusing on individuals such as journalists, activists, politicians, and diplomats. Apple emphasized the severity of these threats and advised recipients to take the notifications seriously. The prevalence of mercenary spyware attacks underscores the evolving landscape of cyber threats, highlighting the need for heightened vigilance and robust security measures among high-risk individuals and organizations.
1 month ago
Kill Chain
Apple's August 2026 Mercenary Spyware Threat Notifications: What You Need to Know
In August 2026, Apple issued threat notifications to users in 110 countries, alerting them to potential mercenary spyware attacks targeting their devices. These sophisticated attacks are typically aimed at individuals based on their profession or activities, such as journalists, activists, politicians, and diplomats. Apple emphasized the severity of these threats and recommended that affected users enable Lockdown Mode and keep their devices updated to mitigate risks. The issuance of these notifications underscores the persistent and evolving nature of mercenary spyware threats. As these attacks become more sophisticated and widespread, it is crucial for individuals and organizations to remain vigilant and adopt comprehensive security measures to protect sensitive information and maintain privacy.
1 month ago
Kill Chain
Russian Intelligence Exploits Fake Support Texts to Breach Messaging Accounts
In June 2026, the Security Service of Ukraine (SSU), in collaboration with the U.S. Federal Bureau of Investigation (FBI), uncovered a prolonged cyber espionage campaign orchestrated by Russian intelligence services. This operation targeted government officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States. The attackers employed social engineering tactics, sending SMS messages that impersonated messaging platform support services to deceive recipients into divulging their account credentials. The primary objective was to access sensitive military, political, and economic information, as well as personal data. ([thehackernews.com](https://thehackernews.com/2026/06/ukraine-says-russian-intelligence-used.html?utm_source=openai)) This incident underscores the escalating sophistication of state-sponsored cyber threats, particularly those leveraging social engineering to exploit human vulnerabilities. Organizations and individuals must remain vigilant, adopting robust security measures such as two-factor authentication and regular monitoring of account activities to mitigate the risks posed by such targeted attacks.
2 months ago
Kill Chain
Sniper Dz Scams Exploit Fake Facebook Offers to Target MENA Users
In June 2026, cybersecurity researchers uncovered a series of fraudulent activities targeting users in the Middle East and North Africa (MENA) region. Cybercriminals employed fake Facebook accounts impersonating politicians, public figures, and trusted organizations to promote deceptive offers such as free mobile internet packages and financial compensations. Victims who clicked on these offers were redirected through a series of intermediary websites leading to phishing pages and monetization schemes, including browser notification abuse and premium SMS subscriptions. This incident highlights the evolving tactics of cybercriminals who exploit social engineering and trusted platforms to deceive users. The use of legitimate services like link-aggregation platforms and browser notifications underscores the need for heightened vigilance and advanced security measures to protect against such sophisticated scams.
3 months ago
Kill Chain
WhatsApp Thwarts NSO Group's Latest Spyware Phishing Attacks
In June 2026, WhatsApp identified and disrupted spear-phishing campaigns linked to the NSO Group, an Israeli spyware vendor known for its Pegasus tool. These attacks involved social engineering tactics, attempting to lure users into clicking malicious links that redirected them to external websites, aiming to deploy spyware. This activity violated a 2025 U.S. court injunction that barred NSO from targeting WhatsApp and its users. Meta, WhatsApp's parent company, responded by filing a federal court contempt order against NSO for this breach. This incident underscores the persistent threat posed by commercial spyware vendors and highlights the importance of robust security measures and legal frameworks to protect user privacy and national security.
3 months ago
Kill Chain
AI-Driven Cyber Threats Targeting 2026 Election Campaign Systems
In the lead-up to the 2026 midterm elections, cybersecurity threats have increasingly targeted the digital infrastructure of political campaigns, including email accounts, websites, and fundraising platforms. A report by Check Point Software Technologies highlights that 82% of malicious attacks arrive through email, with significant numbers of stolen passwords from major fundraising sites like ActBlue and WinRed. Additionally, threat actors have registered numerous election-related domains, potentially for phishing scams. The use of AI has lowered the barrier to entry for attackers, enabling more realistic and effective attacks. ([cyberscoop.com](https://cyberscoop.com/2026-election-cyber-threats-campaign-systems/?utm_source=openai)) This trend underscores a broader shift in the cyber threat landscape, where attackers are leveraging AI to enhance the scale and sophistication of their operations. The focus on campaign systems, rather than voting machines, highlights the need for comprehensive security measures across all facets of the electoral process to safeguard democratic institutions.
3 months ago
Kill Chain
UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation
In 2025, the University of New South Wales (UNSW) conducted 'Capture the Narrative,' a pioneering wargame where students developed AI-driven bots to influence a simulated election on a fictional social media platform. Over four weeks, participants generated over 7 million posts, with more than 60% of content produced by these bots. The exercise demonstrated how AI can be leveraged to manipulate public opinion, resulting in a 1.78% swing that altered the election outcome. This experiment underscores the growing threat of AI-powered influence operations in real-world scenarios. ([unsw.edu.au](https://www.unsw.edu.au/newsroom/news/2026/01/social-media-wargame-reveals-how-ai-bots-can-swing-election?utm_source=openai)) The relevance of this incident is heightened by the increasing use of AI in disinformation campaigns. For instance, Microsoft reported that China has begun employing generative AI to create realistic images supporting divisive U.S. political content, marking a significant evolution in influence operations. ([axios.com](https://www.axios.com/2023/09/08/china-ai-disinformation-microsoft?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports