March 31, 2025
Forensic analysis conducted by Amnesty International has confirmed that two journalists of the Balkan Investigative Reporting Network (BIRN) were the targets of a failed attempt to install powerful Israeli Pegasus spyware on their phones.
The same message, with an infected link, was sent in Serbian to the journalists through Viber from a number registered with Telekom Srbija.
The attack proved unsuccessful because the journalists didn’t click the link. Had they done so, Pegasus would have been installed on their phones and would have granted access to their private messages, emails, camera, microphone and files.
It was determined that the problem related to Pegasus spyware attacks after BIRN turned to the Amnesty International Security Lab for help.
NSO Group, the maker of Pegasus, stated in a letter to Amnesty International that all their systems are “sold exclusively to verified government users”.
Under the scope of this investigation, Amnesty International didn’t identify any government that would have an interest in targeting the two BIRN journalists other than Serbia’s.
An Amnesty International report on spying on activists and journalists in Serbia was published last December and showed that the Serbian police and BIA [Security Information Agency] had used Cellebrite to unlock the phones of journalists and activists. Company Cellebrite later confirmed the results of the analysis and banned Serbia from using its technology.
Serbia’s relevant institutions have failed to solve the case of illegal spying on Bulgarian minority journalist Slaviša Milanov, after more than a year. Despite Milanov having filed a criminal complaint, a response of the authorities has yet to be forthcoming.
