During this time, police would plant “Novispy” — a spyware program that is likely state-developed — on their phones. Some devices were broken into using a (since-patched) Qualcomm vulnerability, Amnesty International explains in the document.

Serbian police allegedly used Cellebrite and NoviSpy spyware to compromise a journalist's phone, exploiting a CVE-2024-43047 vulnerability.

Amnesty said it found NoviSpy, an Android spyware linked to Serbian intelligence, on the phones of several members of Serbian civil society following police stops.

Serbian authorities have rejected the claims they used forensic tools from Israeli company Cellebrite and bespoke spyware for illegal surveillance, calling them "nonsensical". #EuropeNews

As tech companies make it harder to infect phones remotely, governments are using physical access to the devices of activists to insert spyware programs.