Loading story…
Citizen Lab reported forensic evidence indicating Kenyan authorities used Cellebrite phone-extraction technology on the personal device of Kenyan activist and prospective presidential candidate Boniface Mwangi following his arrest amid mass protests. After his phone was returned, Mwangi observed that password protection had been removed, prompting him to submit the device for analysis; researchers concluded the artifacts were consistent with Cellebrite-enabled access intended to extract data from the handset, exposing sensitive personal and political communications.
The investigation identified traces of an application associated with Cellebrite tooling, including an app artifact appearing as com.client.appA, and framed the case as part of a broader pattern in which journalists and civil-society figures have allegedly been targeted with Cellebrite-assisted extractions while detained. Citizen Lab argued that Cellebrite’s stated safeguards—such as ethics review processes—have not prevented repeated alleged misuse in multiple countries, and warned that sales to security services with documented human-rights concerns increase the risk of abuse against activists and dissidents.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
After Citizen Lab’s report, Cellebrite said it has a process to review substantiated misuse allegations and can terminate licenses, but it did not directly answer key questions about Kenya. In subsequent comments, the company argued that Citizen Lab’s findings were not direct evidence and distinguished the case from prior action it took in Serbia.
On February 17, 2026, Citizen Lab published forensic findings saying it had high confidence that Cellebrite technology was used on Mwangi’s phone after his arrest. The report framed the case as part of a broader pattern of alleged misuse of commercial phone-extraction tools against activists and civil society.
On September 4, 2025, authorities returned Mwangi’s seized devices. He reported that his Samsung phone no longer required a password even though he had not provided the passcode, raising concerns that its contents had been accessed.
Citizen Lab found indicators consistent with Cellebrite forensic extraction being used on Mwangi’s Samsung phone while it was in police custody, likely on or around July 20–21, 2025. The artifacts included traces of the app "com.client.appA," which researchers linked to Cellebrite tooling.
On July 19, 2025, Kenya’s Directorate of Criminal Investigations arrested activist and politician Boniface Mwangi, raided his home and Nairobi office, and confiscated multiple electronic devices. He was later released on bail while the case remained active.
Following the June 25, 2025 protests in Kenya, authorities signaled they were investigating Boniface Mwangi for alleged terrorism and money-laundering offenses tied to the demonstrations. The case later shifted to firearms-law charges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcetechcrunch.com
Open sourcethehackernews.com
Open sourcecitizenlab.ca
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An investigation by the University of Toronto’s **Citizen Lab**, published in coordination with **OCCRP**, reported that Jordanian authorities used **Cellebrite** digital forensic tools to gain nonconsensual access to the phones of domestic activists and human rights defenders. Based on forensic analysis of seized-and-returned devices and corroborating court records, Citizen Lab assessed with **“high confidence”** that multiple devices were subjected to Cellebrite forensic extraction during cases tied to enforcement actions under Jordan’s cybercrime framework, including proceedings under the **2023 Cybercrime Law**. Citizen Lab documented at least **seven** cases between late 2023 and mid-2025 (four supported by device forensics and three by court records), involving **three iPhones and one Android** in the forensically analyzed set, and said it is aware of **dozens** of additional instances. The report states the extractions occurred while individuals were interrogated or detained for speech critical of Israel’s campaign in Gaza, and it argues Cellebrite use against civil society in Jordan appears broader and longer-running, with forensic indicators suggesting deployment dating back to **at least 2020**; Citizen Lab called on **Cellebrite** to review its Jordan-related customer use in light of alleged rights abuses.
Jun 29, 2026
Russian authorities used **Cellebrite UFED** phone-forensics technology to access the iPhone of jailed opposition figure **Andrey Pivovarov** in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A **Citizen Lab** investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including **WhatsApp** and **Telegram** messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook. The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including **Anastasiya Burakova**, who was later targeted in a hacking campaign linked to Russia’s **FSB**. Cellebrite said any post-March 2021 use in Russia was **unauthorized**, involved legacy hardware, and would now be ineffective against modern devices.
Jul 12, 2026
Cellebrite said it has suspended the use of some of its digital forensic products by certain customers in Serbia after Amnesty International reported that Serbian police and intelligence services allegedly used the technology to unlawfully extract data from the phones of activists and journalists. Amnesty said its December 2024 investigation found that authorities used mobile device extraction tools outside legally sanctioned procedures and, in some cases, that targeted phones were later infected with spyware. The dispute has intensified scrutiny of Serbia’s treatment of civil society and independent media, with Amnesty arguing that the surveillance activity occurred amid anti-government protests and a broader pattern of pressure on government critics. Amnesty welcomed Cellebrite’s move but called on the company to strengthen human-rights due diligence and urged a halt to exports of surveillance and digital forensics technology to Serbia until effective independent oversight is in place.
Jul 24, 2026