Amnesty International said on Thursday that its experts confirmed the use of spyware to target Balkan Investigative Reporting Network (BIRN) journalists.

It said that two women working for BIRN were targeted with Pegasus spyware installed on their smartphones. “They approached Amnesty International’s Security Lab, whose forensic analysis confirmed their suspicions,” a press release said adding that this is the third time in two years that Amnesty International’s Security Lab has found NSO Group’s Pegasus spyware being used against civil society in Serbia.

The two journalists received messages with links to news items which, if clicked on, redirected to a decoy page on a Serbian media website, a technique previously seen in a Pegasus attempt targeting a Serbian protest leader in July 2023.

“NSO Group stated in a letter to Amnesty International that “all sales of our systems are to vetted government end-users”. Amnesty International believes that the continued use of Serbian language Pegasus infection domain names, and the targeting of Serbian civil society with a consistent methodology are indicative of these attacks being carried out by a Serbian state entity,” the press release said.

Amnesty International shared its findings with NSO Group who responded saying: “We cannot comment on specific existing or past customers. Additionally, as a matter of policy, we are unable to disclose any information regarding the technical specifications, functionality or operational features of our products.”

Repeated attempts to engage the Serbian Security Information Agency (BIA, Bezbednosno-informativna Agencija) were unanswered, the press release said.

Amnesty said the findings are evidence of the use of invasive spyware and added that the Serbian authorities have to stop using spyware and provide effective remedy to victims of unlawful targeted surveillance and hold those responsible for the violations to account. “NSO Group must stop selling Pegasus and the use of its products in Serbia,” it said.