← Conversations archive
VIDEO — 30 Mar 2025

Four ways spyware reaches journalists and activists and five measures against it

A short CDT explainer on how spyware gets onto journalists’ and activists’ phones, and the settings and habits that make it harder.

CDT Crna Gora
Published in
CDT Crna Gora
Role
Speaker
Watch on YouTube

In this short video for CDT I explain how spyware such as Pegasus, Predator and NoviSpy gets onto phones and computers, and how to protect yourself, because journalists and activists are increasingly its targets.

Links, missed calls, seized phones and fake apps

  • —One-click attacks come through a link in an email, SMS, iMessage or WhatsApp message that looks normal and hides malware. Long-press a suspicious link to preview the address, and check it with VirusTotal before you open it.
  • —Zero-click attacks are the most dangerous, because they need no action at all: spyware gets in through a missed call or a message you never open. Turn on Lockdown Mode and restart your phone regularly, preferably every day, because some spyware is deleted on restart.
  • —Spyware can be installed through direct access to the phone. BIRN research and Amnesty International’s forensic analysis recorded cases in Serbia of authorities temporarily taking activists’ phones during detention, when the devices can be unlocked and infected with NoviSpy or similar tools. If someone demands your phone, switch it off at once so that only the passcode unlocks it, and factory-reset a seized phone before using it again.
  • —Spyware also hides in apps that look legitimate, especially on Android, which allows apps from outside Google Play. Install apps only from official stores, check permissions and turn on Google Play Protect, and if a torch app asks for your microphone, something is wrong.

Updates, encryption, safe Wi-Fi and burner phones

  • —Update software as soon as a new version is out and turn on automatic updates, because every update closes security holes that spyware uses.
  • —Use encrypted apps such as Signal for messages and Proton Mail for email, because Pegasus can intercept SMS messages and unprotected calls.
  • —Use strong passcodes and encryption. A phone is encrypted only if it has a PIN or passcode, so instead of a four-digit PIN set one of six or more digits, and turn on BitLocker or FileVault on Windows and macOS.
  • —Do not connect to unknown Wi-Fi networks. Turn off automatic connection and use a VPN on public networks, because Pegasus and similar software sometimes spread through network attacks.
  • —If you are at high risk, use burner phones, cheap devices only for risky conversations, with unregistered prepaid SIM or eSIM cards, lockdown mode on and a restart every day.

The video description has links to step-by-step instructions, which we keep updated, and an email address for anyone who suspects they have been compromised.

More conversations & talks