Serbian authorities used Cellebrite tools to unlock journalist's phone and install spyware
Serbian police and the Security-Information Agency reportedly used Cellebrite's mobile forensic tools and a zero-day Android exploit to unlock phones of journalists and activists without authorization and install spyware, according to an Amnesty International investigation. Cellebrite announced suspension of its products in Serbia following publication of Amnesty's findings of widespread misuse of the technology.
What happened
Serbian police and the Security-Information Agency (BIA) used Cellebrite mobile forensic tools to unlock phones of journalists and activists without authorization.
The authorities used a zero-day exploit targeting Android USB kernel drivers to bypass security mechanisms, enabling installation of the NoviSpy spyware during police custody and interrogations.
At least two documented cases showed Cellebrite UFED exploits used to extract data and install NoviSpy on targeted devices, with evidence of at least two further cases of misuse discovered by Amnesty International.
Reported impact
The unauthorized phone unlocking and spyware installation enabled Serbian authorities to collect sensitive personal data from journalists and activists, and to remotely activate microphones and cameras on targeted phones.
The zero-day exploit targeting Android USB drivers could potentially impact over a billion Android devices worldwide, representing a broad security risk beyond the documented cases in Serbia.
Index analysis
The misuse of Cellebrite tools by Serbian authorities represents a systematic surveillance campaign targeting civil society, documented in Amnesty International's December 2024 report 'A Digital Prison'.
Cellebrite announced suspension of its products with 'relevant customers' in Serbia on 25 February 2025 following the Amnesty report.
Governance controls
Amnesty International shared technical evidence of the zero-day exploit chain with industry partners in 2024 and published detailed findings in December 2024 and February 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.