Amnesty International has exposed Serbian police’s use of Cellebrite’s forensic tools to extract data from journalists and activists’ phones, followed by the installation of a new Android spyware called NoviSpy. The spyware is suspected to be linked to the Serbian intelligence services, highlighting the misuse of surveillance technology against civil society and journalists. This sophisticated attack vector showcases a dangerous trend of using Cellebrite’s device-unlocking technology to plant malware.