Loading story…
An investigation by the University of Toronto’s Citizen Lab, published in coordination with OCCRP, reported that Jordanian authorities used Cellebrite digital forensic tools to gain nonconsensual access to the phones of domestic activists and human rights defenders. Based on forensic analysis of seized-and-returned devices and corroborating court records, Citizen Lab assessed with “high confidence” that multiple devices were subjected to Cellebrite forensic extraction during cases tied to enforcement actions under Jordan’s cybercrime framework, including proceedings under the 2023 Cybercrime Law.
Citizen Lab documented at least seven cases between late 2023 and mid-2025 (four supported by device forensics and three by court records), involving three iPhones and one Android in the forensically analyzed set, and said it is aware of dozens of additional instances. The report states the extractions occurred while individuals were interrogated or detained for speech critical of Israel’s campaign in Gaza, and it argues Cellebrite use against civil society in Jordan appears broader and longer-running, with forensic indicators suggesting deployment dating back to at least 2020; Citizen Lab called on Cellebrite to review its Jordan-related customer use in light of alleged rights abuses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Following publication of the report, Cellebrite said it does not comment on specific customers or cases, maintained that it vets customers and licenses its technology only for lawful and ethical use, and disputed broader criticism of its accountability.
On January 22, 2026, Citizen Lab published findings based on forensic analysis of four returned phones and three court cases, concluding with high confidence that Jordanian authorities used Cellebrite against civil society members.
Jordanian court records in multiple prosecutions described Cellebrite 'Advanced Logical Image' extractions and use of Cellebrite Physical Analyzer, including at least one case where the tool could not bypass a passcode.
Between late 2023 and mid-2025, Jordanian authorities used Cellebrite forensic tools to extract data from at least seven activists, journalists, and human rights defenders after seizing their devices during interrogations or detention tied to speech and protests related to Gaza.
Jordan expanded its cybercrime law in 2023, a legal framework that reporting says was later used to prosecute online speech and formed part of the context for phone seizures and data extraction cases.
Citizen Lab said forensic indicators on activists’ devices suggest Jordanian authorities have deployed Cellebrite mobile forensic tools against civil society since at least 2020, indicating the practice predates the later documented cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Citizen Lab** reported forensic evidence indicating Kenyan authorities used **Cellebrite** phone-extraction technology on the personal device of Kenyan activist and prospective presidential candidate **Boniface Mwangi** following his arrest amid mass protests. After his phone was returned, Mwangi observed that password protection had been removed, prompting him to submit the device for analysis; researchers concluded the artifacts were consistent with Cellebrite-enabled access intended to extract data from the handset, exposing sensitive personal and political communications. The investigation identified traces of an application associated with Cellebrite tooling, including an app artifact appearing as `com.client.appA`, and framed the case as part of a broader pattern in which journalists and civil-society figures have allegedly been targeted with Cellebrite-assisted extractions while detained. Citizen Lab argued that Cellebrite’s stated safeguards—such as ethics review processes—have not prevented repeated alleged misuse in multiple countries, and warned that sales to security services with documented human-rights concerns increase the risk of abuse against activists and dissidents.
Jun 29, 2026
Russian authorities used **Cellebrite UFED** phone-forensics technology to access the iPhone of jailed opposition figure **Andrey Pivovarov** in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A **Citizen Lab** investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including **WhatsApp** and **Telegram** messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook. The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including **Anastasiya Burakova**, who was later targeted in a hacking campaign linked to Russia’s **FSB**. Cellebrite said any post-March 2021 use in Russia was **unauthorized**, involved legacy hardware, and would now be ineffective against modern devices.
Jul 12, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026