- summary
- On 14 February 2025, two BIRN Serbia journalists received near-identical Viber messages from an unknown Serbian number on the Telekom Srbija network, containing links to a Serbian-language domain that Amnesty International's Security Lab determined with high confidence to be Pegasus (NSO Group) infrastructure. Neither journalist opened the link and no infection was found. Amnesty (27 March 2025) attributed the attempts to Serbian state actors, citing the consistent use of Serbian-language infection domains and the targeting pattern, and called it the third documented Pegasus targeting of Serbian civil society in two years. The Security Information Agency (BIA) did not respond to requests for comment.
- country
- Serbia
- date text
- 14/02/2025
- entities
- Serbian state actors (Amnesty attribution, high confidence on Pegasus infrastructure); BIA did not respond
- entity type
- Security Apparatus (suspected)
- id
- 1151
- name
- Serbian state actors (Amnesty attribution, high confidence on Pegasus infrastructure); BIA did not respond
- role
- actor
- Two investigative journalists of the Balkan Investigative Reporting Network (BIRN) Serbia, including Jelena Veljković
- entity type
- Individual — Journalist
- id
- 1152
- name
- Two investigative journalists of the Balkan Investigative Reporting Network (BIRN) Serbia, including Jelena Veljković
- role
- target
- Serbian state actors (Amnesty attribution, high confidence on Pegasus infrastructure); BIA did not respond
- sources
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Direct Intimidation of Journalists and Civic Actors
- label
- Direct Intimidation of Journalists and Civic Actors
- code
- TC-51
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- campaign ids
- channels
- One-click spyware attack attempt via Viber message with Pegasus link (Telekom Srbija number)
- civic response
- The journalists recognised and did not open the links; BIRN and Amnesty International's Security Lab made the attempts public (27 Mar 2025) and called on Serbia to stop unlawful surveillance of journalists and civil society.
- consequence category
- Operational Suppression
- created at
- 2026-09-25T12:58:48.165259+00:00
- date precision
- day
- escalation
- 3
- harm track
- Track 3 — Operational Suppression
- id
- SRB-124
- institutional consequence
- Chilling effect
- notes
- Coded Sep 25 2026. Secondary TC-51: targeting of journalists. Links: SRB-123 (2023 attempts), SRB-122 (NoviSpy/Cellebrite, 2024), SRB-121 (2026 wave). Campaign SRB-CAMP-018. Escalation 3: suspicious spyware link received; no infection. (Spyware thresholds, Sep 25 2026.) UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).
- occurred on
- 2025-02-14
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T14:48:23.40409+00:00
- version
- 2
The public research collection