FlagThis

Amnesty International's Security Lab has uncovered evidence that two investigative journalists from the Serbia-based Balkan Investigative Reporting Network (BIRN) were targeted with NSO Group’s Pegasus spyware in February 2025. This marks the third time in two years that Amnesty International has found Pegasus being used against civil society members in Serbia, building upon previous findings detailed in their December 2024 report, "A Digital Prison." The journalists received suspicious text messages, and research confirmed the links led to a domain previously identified as part of NSO Group's infrastructure.

These latest findings reinforce concerns about Serbian authorities abusing invasive spyware to target journalists, activists, and other members of civil society. NSO Group responded to Amnesty International's findings by stating they cannot comment on specific customers or disclose technical information, while reiterating their commitment to respecting human rights and upholding the UN Guiding Principles on Business and Human Rights. Despite this commitment, security researchers are increasingly able to detect Pegasus attacks, suggesting challenges for NSO Group in maintaining operational security and concealing their activities.

ImgSrc: mnwa9ap4czgf-u1

References :

• securitylab.amnesty.org: Journalists targeted with Pegasus spyware - Amnesty International Security Lab
• CyberInsider: Viber Messenger Abused for Delivering Pegasus Spyware on Targets
• thecyberexpress.com: Investigative Journalists in Serbia Hit by Advanced Spyware Attack
• techcrunch.com: Again and again, NSO Group’s customers keep getting their spyware operations caught

Classification:

• HashTags: #Pegasus #Spyware #Serbia
• Company: NSO Group
• Target: Two investigative journalists in Serbia
• Attacker: Amnesty International
• Product: Viber
• Feature: Spyware
• Malware: Pegasus
• Type: Espionage
• Severity: Major