Nile Phish phishing campaign against Egyptian civil society

On 2 February 2017, the University of Toronto's Citizen Lab, working with Egyptian NGOs, published Nile Phish, documenting a large-scale, highly personalized phishing campaign aimed at the heart of Egypt's human-rights community. The operators sent at least 92 credential-stealing messages, almost all targeting people and organizations entangled in "Case 173" — the Egyptian government's sweeping legal crackdown on civil-society groups accused of receiving foreign funding.

What happened

Nile Phish unfolded in two phases. The first, beginning in late November 2016, used hyper-personalized lures that demonstrated an unsettling, real-time awareness of the targets' lives and of Egyptian state action. In the most striking example, within hours of the arrest of women's-rights activist Azza Soliman on 7 December 2016, her colleagues received emails purporting to share a copy of her arrest warrant — actually a credential-harvesting trap. Other lures impersonated event invitations, travel-ban notifications, and shared documents.

The second phase shifted to more generic content — fake Gmail and Dropbox "account security" warnings and package-delivery notices — spread across dozens of attacker-controlled domains. The operators relied on the open-source Gophish framework and roughly 33 domains hosted on European providers. Crucially, the attacks used classic credential phishing rather than malware, sidestepping antivirus detection and exploiting the targets' reliance on Gmail and Dropbox.

Impact

• At least 92 phishing messages documented against 7 named NGOs plus numerous individual activists, lawyers, and journalists.
• Targeted organizations included the Egyptian Initiative for Personal Rights (EIPR), the Cairo Institute for Human Rights Studies (CIHRS), the Association for Freedom of Thought and Expression (AFTE), the Egyptian Commission for Rights and Freedoms (ECRF), Nazra for Feminist Studies, and the Nadeem Center.
• Nearly all victims were implicated in Case 173, which already subjected them to asset freezes, travel bans, and arrests.

Attribution

Citizen Lab explicitly declined to conclusively attribute Nile Phish to a specific sponsor. However, it emphasized that the campaign showed "intimate familiarity" with the targeted NGOs' activities and an ability to phish within hours of Egyptian government actions — including arrests and prosecutorial moves in Case 173. The report noted this timing strongly suggested either coordination with, or close access to, Egyptian state operations.

Why it matters

Nile Phish became a landmark case in digital repression of civil society. It showed that effective, large-scale surveillance of dissidents does not require costly exploits or commercial spyware — well-crafted, context-aware phishing can be devastatingly effective against under-resourced NGOs. The campaign's tight synchronization with judicial and police actions in Case 173 illustrated how legal persecution and cyber-operations can reinforce each other, and it cemented Citizen Lab's methodology of pairing technical analysis with on-the-ground human-rights documentation.