A new espionage campaign against the Arabian Peninsula has exposed OilAlpha threat actors to new media attention. Historically, the OilAlpha threat group has targeted numerous sectors including political figures/officials, media outlets, and journalists through espionage-related campaigns. In their newest campaign, OilAlpha threat actors have changed up some of their targets to include non-governmental organizations, humanitarian, and development industries. Tactics utilized by threat actors in this campaign include deployment of the remote access tools “SpyNote” and “SpyMax” across mobile devices, often exploiting Arabic-speaking individuals using Android devices. Utilizing social engineering techniques, OilAlpha actors attempted to communicate with journalists and political figures over encrypted chat platforms such as WhatsApp by luring users in with Yemeni-related security and development matters. Should social engineering be successful, the deployed SpyNote and SpyMax malware allows for the continuous collection and exfiltration of the mobile device’s network configuration, camera and audio recording, SMS data, contacts list, call logs, and location data. Technical details associated with recent OilAlpha attacks are included in the report below. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.