Pegasus spyware attack on BIRN journalists unsuccessful
Two journalists at the Balkan Investigative Reporting Network (BIRN) in Serbia received malicious Viber messages on 14 February 2025 containing links to Pegasus spyware, according to a forensic analysis by Amnesty International. The journalists did not click the links and the attack was unsuccessful.
What happened
Two BIRN journalists received suspicious messages on 14 February 2025 via Viber from a phone number (+381659940263) registered with Telekom Srbija containing Serbian-language text and potentially malicious links. The messages appeared to come from the same number within less than an hour and directed to a fake N1 info website at https://n1info.com.
One journalist reported the message appeared to be a source trying to share information. Another journalist, Jelena Veljković, stated the message was obscured by Viber's security mechanism and she immediately blocked the number without clicking the link.
Reported impact
Amnesty International's forensic analysis confirmed the journalists were targets of an unsuccessful Pegasus spyware installation attempt developed by Israeli company NSO Group. The analysis identified that the text messages contained links to a Serbian-language internet domain with high confidence linked to NSO Group's Pegasus spyware.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.