NoviSpy: How Advanced Spyware is Silencing Voices in Serbia

In the digital age, technology is supposed to empower people. But in Serbia, it is being weaponized to silence journalists, activists, and civil society. A recent report by Amnesty International reveals how Serbian authorities are using advanced spyware called NoviSpy, along with data extraction tools from the Israeli company Cellebrite, to spy on individuals. This raises serious concerns about privacy, freedom of speech, and human rights.

What is NoviSpy?

NoviSpy is a powerful spyware program designed to infiltrate Android devices. Once installed, it gives operators near-total control over a device's functions, including access to:

• Messages, photos, and documents: NoviSpy retrieves both existing and deleted data stored on the phone.
• Microphone and camera: Operators can remotely activate these features, turning the phone into a live listening and surveillance device.
• Location and activity data: The spyware tracks user movements in real time and monitors app usage, calls, and browsing habits.

Unlike Pegasus, which can be installed remotely, NoviSpy requires physical access to the target device to install. This installation process is often facilitated by advanced forensic tools like Cellebrite's UFED (Universal Forensic Extraction Device).

How Cellebrite Technology Helps

Cellebrite develops forensic tools widely used by law enforcement agencies to access and extract data from locked mobile devices. While these tools are marketed for lawful purposes, Amnesty's report highlights how they are being misused in Serbia to install spyware like NoviSpy.

Cellebrite's tools enable authorities to:

• Bypass device security: The UFED suite can unlock phones without requiring the passcode, even on newer Android and iOS devices.
• Extract complete data: Including contacts, messages, media files, app data, and deleted information.
• Prepare devices for spyware installation: Once unlocked, the device becomes vulnerable to malware like NoviSpy, which can be discreetly installed.

For example, Serbian journalist Slaviša Milanov was detained under false pretenses, during which his phone was confiscated. Forensic evidence later showed Cellebrite's tools had been used to unlock his device, after which NoviSpy was installed. Similar cases have been reported involving environmental activists and civil society leaders.

Who is Being Targeted?

The Serbian authorities' use of NoviSpy reveals a disturbing trend:

• Journalists: Investigative reporters like Slaviša Milanov are being targeted to disrupt their ability to expose corruption or hold authorities accountable.
• Activists: Environmental campaigners like Nikola Ristić face surveillance aimed at suppressing grassroots movements and silencing dissent.
• Civil Society Organizations: Groups advocating for human rights and democracy are under surveillance, making it harder for them to organize and operate safely.

These tactics are designed to create an atmosphere of fear, discouraging individuals from speaking out against injustices.

How Malloc Privacy & Security Can Help

In the fight against invasive surveillance tools like NoviSpy, Malloc Privacy & Security offers a defence that runs on the device itself, so detection does not depend on sending your data anywhere else. Malloc's mobile security app gives users:

• Spyware detection: It looks for suspicious app behaviour and unauthorized access attempts, and alerts you when something looks wrong. It cannot promise to catch every spyware family, and it does not claim to detect Pegasus specifically.
• Data leakage protection: It flags sensitive information, such as photos, location data, and messages, being sent to suspicious servers or websites.
• Encrypted traffic: With Malloc's VPN, your internet traffic is encrypted, which helps protect it from interception on untrusted networks.
• Spyware activity logs: Users can view reports of blocked threats, helping them understand the risks and take proactive measures.

For journalists, activists, and civil society members, tools like these are one part of a wider plan. More on protecting high-risk individuals and our VIP protections. Malloc detects and reduces risk; it cannot defeat spyware that is installed on an unlocked device by someone with physical access.

The misuse of NoviSpy and Cellebrite technology highlights the dangers of unchecked surveillance tools. As technology advances, so must our efforts to protect human rights and freedom. To learn more about how Malloc can help you stay secure, visit Malloc Privacy & Security.

Sources: Amnesty International, Reuters, Access Now.

Published on Medium