Loading story…
Cellebrite said it has suspended the use of some of its digital forensic products by certain customers in Serbia after Amnesty International reported that Serbian police and intelligence services allegedly used the technology to unlawfully extract data from the phones of activists and journalists. Amnesty said its December 2024 investigation found that authorities used mobile device extraction tools outside legally sanctioned procedures and, in some cases, that targeted phones were later infected with spyware.
The dispute has intensified scrutiny of Serbia’s treatment of civil society and independent media, with Amnesty arguing that the surveillance activity occurred amid anti-government protests and a broader pattern of pressure on government critics. Amnesty welcomed Cellebrite’s move but called on the company to strengthen human-rights due diligence and urged a halt to exports of surveillance and digital forensics technology to Serbia until effective independent oversight is in place.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In December 2024, Amnesty International reported that Serbian police and intelligence services used Cellebrite digital forensic tools to unlawfully extract data from activists' and journalists' phones and, in some cases, those devices were subsequently infected with spyware.
By 2025-02-26, Cellebrite had decided to stop some Serbian customers from using its digital forensic products following Amnesty International's allegations of misuse by Serbian authorities.
On 2025-02-25, Cellebrite published a statement addressing Amnesty International's report about alleged misuse of its products in Serbia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian authorities used **Cellebrite UFED** phone-forensics technology to access the iPhone of jailed opposition figure **Andrey Pivovarov** in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A **Citizen Lab** investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including **WhatsApp** and **Telegram** messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook. The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including **Anastasiya Burakova**, who was later targeted in a hacking campaign linked to Russia’s **FSB**. Cellebrite said any post-March 2021 use in Russia was **unauthorized**, involved legacy hardware, and would now be ineffective against modern devices.
Jul 12, 2026
Amnesty International reported that Serbian authorities used **Cellebrite forensic tooling** to compromise the Android phone of a student activist, tying the intrusion to a zero-day exploit chain that enabled unauthorized access to the device. The findings expanded Amnesty’s broader documentation of digital surveillance and repression in Serbia, describing targeted mobile compromise as part of a wider campaign against civil society. Google Project Zero separately published technical research on a Qualcomm DSP driver exploit, adding detail on how Android exploitation chains can be built from low-level driver flaws. Google later shipped Android security updates fixing 62 vulnerabilities, including two **actively exploited** zero-days, `CVE-2024-53150` and `CVE-2024-53197`, both affecting Android kernel USB-audio ALSA drivers. Security advisories said the bugs could enable out-of-bounds memory reads, exposure of sensitive data, and privilege escalation, and noted reporting that `CVE-2024-53197` had been used via Cellebrite tooling in the Serbian case. Defenders were urged to apply the `2025-04-05` Android security update immediately on affected devices.
Jul 23, 2026
An investigation by the University of Toronto’s **Citizen Lab**, published in coordination with **OCCRP**, reported that Jordanian authorities used **Cellebrite** digital forensic tools to gain nonconsensual access to the phones of domestic activists and human rights defenders. Based on forensic analysis of seized-and-returned devices and corroborating court records, Citizen Lab assessed with **“high confidence”** that multiple devices were subjected to Cellebrite forensic extraction during cases tied to enforcement actions under Jordan’s cybercrime framework, including proceedings under the **2023 Cybercrime Law**. Citizen Lab documented at least **seven** cases between late 2023 and mid-2025 (four supported by device forensics and three by court records), involving **three iPhones and one Android** in the forensically analyzed set, and said it is aware of **dozens** of additional instances. The report states the extractions occurred while individuals were interrogated or detained for speech critical of Israel’s campaign in Gaza, and it argues Cellebrite use against civil society in Jordan appears broader and longer-running, with forensic indicators suggesting deployment dating back to **at least 2020**; Citizen Lab called on **Cellebrite** to review its Jordan-related customer use in light of alleged rights abuses.
Jun 29, 2026