Journalists and activists: how to protect yourself from modern spyware
Pegasus, Predator and NoviSpy turn a phone into a surveillance device. A practical threat model for people who are actually targeted.
Written for journalists and activists, this piece treats commercial and state spyware as a working threat, not a headline. Once installed, Pegasus, Predator or Serbia’s domestically built NoviSpy give an attacker everything: messages, calls, passwords, location, camera and microphone.
The evidence base is Amnesty International’s research in Serbia, which documented at least seven cases of targeting or infection among protest organisers, journalists and civil-society figures — including phones taken during police “informative talks”, infected, and handed back.
Four infiltration paths are described with a defence for each: one-click attacks through malicious links, zero-click attacks requiring no user action at all, direct installation while a device is physically confiscated, and malicious apps disguised as legitimate software. The countermeasures are specific — checking links through VirusTotal, enabling Lockdown Mode, rebooting daily, powering a phone off immediately if it is seized and factory-resetting it afterwards, avoiding sideloaded Android apps, keeping software current, using Signal and encrypted mail, full-disk encryption, a VPN instead of open Wi-Fi, and a burner phone in genuinely high-risk situations.
Key findings
- 01Three named tools define the threat: Pegasus, Predator and Serbia’s domestically built NoviSpy.
- 02Amnesty International documented at least seven cases of targeting or infection among journalists, activists and civil society in Serbia.
- 03Police detentions have been used as an installation vector: phones confiscated, infected, then returned.
- 04Four infiltration paths: one-click links, zero-click exploits, physical access and malicious apps disguised as legitimate.
- 05Concrete defences: Lockdown Mode, VirusTotal link checks, daily reboots, Signal and encrypted mail, full-disk encryption and a VPN.
- 06For high-risk work: power the phone off the moment it is seized, factory-reset after return, and use a burner device.