Research shows human rights activists in India were targeted with spyware

Human rights activists in India were targeted by a coordinated spyware campaign, according to research published by Amnesty International and Citizen Lab.

Human rights activists in India were targeted by a coordinated spyware campaign from January to October of 2019, according to research published Monday by Amnesty International and the University of Toronto’s Citizen Lab.

Nine activists in total were targeted, eight of which have been calling for the release of 11 people jailed during protests related to the violent uprising in Bhima Koregaon, India in 2018.

The targets were sent spearphishing emails with malicious links and files that, if clicked, would infect the victims’ computers with spyware capable of tracking their communications. Three of the activists were also alleged to have been targeted by Pegasus, a notorious spyware program developed by Israeli surveillance software firm NSO Group last year.

Human rights defenders in India have been victimized by spyware in the past. But the research shows that surveillance software has been leveraged multiple times against activists linked to the Bhima Koregaon activists. One of the activists who was imprisoned following the protests, Anand Teltumbde, alleged last year that someone used NSO’s software in an attempt to hack his devices.

“That some of these individuals were targeted multiple times shows that there is a disturbing pattern of spyware attacks against [human rights defenders] involved in the Bhima Koregaon case,” the researchers wrote in a blog post about the campaign. “This spyware campaign is very concerning in the context of an already perilous situation for [human rights defenders] in India where surveillance is used along with threats, imprisonment and smear campaigns against activists to shrink the space for civil society.”

The case against the Bhima Koregaon protesters has relied “almost entirely on digital evidence obtained from the arrested activists’ devices,” according to Amnesty and Citizen Lab. In 2018, Indian police are alleged to have released materials found on the activists’ devices to smear them.

NSO Group has historically claimed its tools can only be used by law enforcement and government-run intelligence agencies.

“As written in the report, the most recent alleged discoveries have no links to NSO. All other allegations are recycled and misleading,” an NSO spokesperson told CyberScoop in a statement.

The perpetrators behind the new campaign, whose identities remain unknown, also tricked the activists with spearphishing emails that purported to be from journalists, officials from local courts or other people who knew the targets. The perpetrators used links to lead targets to a file hosted on Mozilla’s file-sharing platform Firefox Send, in a likely effort to avoid malware and email filters. The malware was delivered by files that looked like PDFs, but which were actually malicious Windows programs.

The campaign then would deploy commercially available spyware capable of logging keystrokes and stealing credentials and audio recordings. The malware, NetWire, has been used in the past by criminal groups and in corporate espionage incidents. In April, researchers for BlackBerry Cylance found evidence that tied NetWire to a Chinese-based hacking collective known as Winnti Group.

The news comes just one week after Citizen Lab revealed a hack-for-hire business in India has been targeting activists, journalists, and investment firms for approximately seven years in multiple credential-stealing campaigns.

“We currently have no evidence showing any link with the hacker-for-hire research published by the Citizen Lab recently,” a spokesperson from Amnesty International told CyberScoop.

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia…

Russia uses Cellebrite to break into human rights activist’s phone, even after cancellation of contract

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems