Loading malware…
NoviSpy is Android spyware publicly identified in Serbia in 2024 and associated with surveillance operations conducted by Serbian police and the Security Information Agency (BIA). Documented targets include journalists, environmental activists, student protesters, and other civil-society members. It collects and exfiltrates sensitive device data, captures screenshots of communications and application activity, and allows operators to remotely activate the microphone and camera. Recovered surveillance data has included screenshots of email, Signal and WhatsApp conversations, and social-media activity.
Documented infections involved physical access to phones confiscated during arrests, detention, or police and intelligence interviews. Authorities used Cellebrite forensic tools to unlock devices or bypass security protections before installing NoviSpy; the forensic tools and spyware are distinct components of this workflow. Exploitation of the Qualcomm vulnerability CVE-2024-43047 was also associated with operations enabling NoviSpy deployment. Technical analysis of its code and command-and-control infrastructure linked the spyware to BIA with high confidence. Subsequent infections on student activists’ Android devices included updated spyware with enhanced detection-evasion mechanisms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Last November, the company addressed a second Android zero-day (CVE-2024-43047) used by the Serbian government in NoviSpy spyware attacks, which was first tagged as exploited by Google Project Zero in October.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Evidence from the NoviSpy infections pointed to Serbian government authorities.
NoviSpy (nouvelle variante) : implant Android identifié pour la première fois en Serbie en 2024 ; la nouvelle variante a été confirmée sur deux appareils supplémentaires par Amnesty Security Lab.
NoviSpy, a previously unknown Android spyware, provides Serbian authorities with extensive surveillance capabilities once installed on a target’s device. It was installed on devices while targets were detained or interviewed by Serbian police or the BIA.
Amnesty’s Security Lab, analyzed Milanov’s phone and indeed found that it had been unlocked using Cellebrite and had installed an Android spyware that Amnesty calls NoviSpy, from the Serbian word for “new.”
Amnesty’s Security Lab, analyzed Milanov’s phone and indeed found that it had been unlocked using Cellebrite and had installed an Android spyware that Amnesty calls NoviSpy, from the Serbian word for “new.”
Last November, the company addressed a second Android zero-day (CVE-2024-43047) used by the Serbian government in NoviSpy spyware attacks...
10 distinct techniques documented for this family, organized by ATT&CK tactic.
„На телефонот на уште еден член на студентското движење бил инсталиран нова верзија на Android шпионскиот софтвер NoviSpy, откако неговиот уред бил одземен за време на полициско испрашување.“
Serbian authorities used Cellebrite to exploit a zero-day vulnerability in Android devices to gain privileged access to an environmental activist’s phone. Cellebrite UFED exploits were also used to bypass Android device security mechanisms.
Authorities used Cellebrite UFED exploits to unlock detainees’ devices during police interviews, enabling the covert installation of spyware.
„нов Android шпионски софтвер, сличен по функционалност на NoviSpy, но новоизграден со конкретни напори за да се избегне негово откривање од страна на безбедносни експерти.“
„истиот вид шпионски софтвер бил откриен и на втор уред, откако приватни Viber пораки од тој телефон биле јавно прикажани во живо на Informer TV“
“Pegasus and NoviSpy spyware both have extraordinary snooping capabilities and can see photos, contacts, messages and files stored on phones.” A confirmed NoviSpy victim’s text messages were read live on a television network.
„истиот вид шпионски софтвер бил откриен и на втор уред, откако приватни Viber пораки од тој телефон биле јавно прикажани во живо на Informer TV“
Amnesty International was also able to recover and decrypt surveillance data captured by NoviSpy ... which included screenshots of email accounts, Signal and WhatsApp messages and social media activity.
Spyware “can take over and turn on microphones,” allowing operators to hear “even conversations happening near, but not on, the phone.”
NoviSpy can capture sensitive personal data from a target phone and provide capabilities to turn on a phone’s microphone or camera remotely.
Amnesty researchers found that NoviSpy was designed to communicate with a specific IP address: 195.178.51.251.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android spyware reported on two phones in the earlier 2026 Serbian targeting wave. Amnesty International's December 2024 reporting described NoviSpy installations on activists' and journalists' phones during police questioning after devices were unlocked with Cellebrite forensic tools. It was configured to send stolen data to a server whose IP address belonged to Serbia's Security Information Agency (BIA); that infrastructure connection does not establish who conducted the newly reported attacks.
Android spyware mentioned as background to the newly reported Serbian surveillance cases. A new version appeared in an earlier surveillance wave, while Amnesty International’s original 2024 report identified journalists, activists, and civil society members as targets. The article does not link NoviSpy to either newly investigated device.
Spyware identified on phones of Serbian student activists and other targets; the cited investigative groups assessed that evidence from these infections pointed to Serbian government authorities.
Implant Android de surveillance conçu pour contourner les méthodes de détection qui avaient exposé une version antérieure. Des infections auraient notamment eu lieu après la saisie de téléphones d’étudiants par la police.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.