Thread by @razhael

Yesterday I reported on the attempts to digitally compromise @AliAlAhmed_en, a DC-based Saudi opposition figure. The hackers masqueraded as journalists for the BBC and the WaPo, but they also tried other tactics too. Here’s one that caught my eye ...
apnews.com/cee0e8a5338e4b…

In May of this year the hackers sent him a message that (badly) mimicked an event photography service, sending him a link to what were apparently pictures of him at a recent event. That’s Ali in the picture below, holding the microphone. 🎤
documentcloud.org/documents/5028…

Here’s the thing: That photo isn’t publicly available. You wouldn’t get it by doing a Google image search for Ali, for example.

The phishing message doesn’t make it clear, but Ali said the pics came from a Feb. 1 event at @AEI, the DC think tank.
aei.org/events/changin…

Here’s the video in question. Skip forward to 36:00 and you’ll hear Ali’s question and then briefly see him handle the microphone.

Here’s a screenshot I took off the same video, which is what I suspect the hackers did too. But how would they know to sit through an @aei video from four months previous to find photos of Ali?

The whole thing is rather eerie. Ali wasn’t listed as a participant (he was a member of the audience) and while he was quoted in the event transcript (link in AEI page above) it’s not clear how you’d know to look there unless you already knew he had asked a question.

I have admittedly very limited experience but this is the first case I’ve encountered personally where traditional surveillance (whether physically at the event or remotely by someone who watches the DC think tank scene closely) has been leveraged to craft a phishing message.