For many civil society organizations investigating spyware attacks against journalists, activists, and human rights defenders, the Mobile Verification Toolkit (MVT) and Android Quick Forensics (AndroidQF) have become essential tools. Developed and maintained by Amnesty International’s Security Lab alongside a community of contributors, these open-source tools have helped establish the field of consensual digital forensics.  

We are presenting here our most complete analysis to date of the Pegasus spyware. This blog post builds on previous technical reports and forensic investigations by Amnesty International’s Security Lab. Significantly it also draws on previously unpublished internal NSO Group marketing material and internal technical material which was disclosed as part of a long-running civil case taken by WhatsApp and Meta against NSO Group in a U.S. court.

On 3 July, 2026, a forensic analysis by the Citizen Lab revealed that Stelios Kouloglou, former Member of the European Parliament and investigative journalist, was targeted and infected with Pegasus spyware, developed by NSO Group,on or around October 21, 2022, and again on March 6 and 7, 2023. At the time, Kouloglou was serving as a substitute member of the Parliament’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee).

Google has today announced the launch of a new ‘Android Intrusion Logging’ feature as part of Android Advanced Protection Mode (AAPM). The new intrusion logging feature promises to be a major aid to digital forensics researchers undertaking investigations into sophisticated attacks on Android devices. This is the first time a major device vendor has release a feature specifically to enhance the ability to forensically detect and respond to advanced digital threats.

A new Amnesty International investigation has established that Predator spyware was used in 2024 to target Teixeira Cândido, a prominent Angolan journalist, press freedom activist, jurist and former Secretary General of the Syndicate of Angolan Journalists (SJA). 

A new investigation by Amnesty International’s Security Lab has discovered evidence that the Predator spyware was used in 2024 to target Teixeira Cândido – an Angolan journalist, jurist, press freedom activist, and former Secretary-General of the Syndicate of Angolan Journalists (Sindicato dos Journalists Angolanos). This is the first forensically confirmed case of the Predator spyware being used to target civil society in Angola. 

The “Intellexa Leaks”, a new investigation published jointly by Inside Story, Haaretz and WAV Research Collective, presents troubling revelations about the surveillance company Intellexa and its signature product Predator, a form of highly invasive spyware that has been linked to human rights abuses in multiple countries.

Authoritarian governments of the twentieth century might have required a network of thousands of employees and informants to track their opponents. Today, the same level of surveillance can be achieved with just a few clicks through spyware, a tool that can turn any smartphone into a 24/7 surveillance device.

Responding to a Lighthouse Reports publication documenting how First Wap, a surveillance company registered in Indonesia, has allegedly been covertly selling its products to state and private actors by exploiting gaps in export control regulations, Elina Castillo Jiménez, Advocacy and Policy Advisor for the Security Lab at Amnesty International, said:  

Our September report “Shadows of Control” revealed that Pakistan is running a huge unlawful surveillance and censorship system. Built with foreign tech and carried out without warrants and safeguards, this is enabling human rights abuses on a massive scale. The report underscores the urgent need for stronger safeguards, greater transparency, and robust accountability mechanisms, all grounded in a human-rights based approach, to prevent the further erosion of digital and human rights in Pakistan and beyond.

On 6 August, the Pakistani authorities announced they were shutting down mobile internet services in Balochistan, Pakistan’s largest province.  

Journalists in Pakistan are routinely subject to harassment, arrests and even enforced disappearances. In this backdrop, journalists are also reporting experiencing a high level of surveillance, both online and offline.