A Serbian student’s Android phone was compromised through a zero-day exploit reportedly sold by a controversial vendor, highlighting a broader pattern of surveillance tactics used against civil society. Amnesty International’s latest findings indicate that a chain of exploits could defeat the lock screen on fully patched Android devices, raising questions about the balance between legitimate investigative tools and their potential misuse by authorities. The report ties this incident to a wider campaign of surveillance and repression targeting dissenting voices in Serbia, a pattern Amnesty had previously documented in December. In response to those earlier concerns, the exploit vendor suspended sales to Serbia, but new evidence shows the chain’s continued availability and potential use. The case underscores ongoing tensions between security technology, privacy rights, and state power, especially for activists and protesters who rely on digital devices to organize and communicate. It also spotlights how patch cycles, vendor accountability, and government practices intersect in real-world risk scenarios for everyday device users.
Background and Timeline of Allegations
Amnesty International has long scrutinized Serbia for what it describes as pervasive and routine use of spyware against civil society actors. The organization’s December report charged the Serbian authorities with deploying exploit tools obtained from multiple sources, including Cellebrite and a separate vendor known for similar practices, to monitor, disrupt, and suppress critical voices. The December findings asserted that these tools were part of a broader campaign of state surveillance and control, aimed at curbing dissent and undermining independent civic activity. In response to those revelations, Cellebrite stated that it had halted sales to “relevant customers” in Serbia, signaling a concern about the misuse of its technology in the country and a willingness to reassess its client base in sensitive jurisdictions. This admission, while partial, suggested that the vendor recognized the potential for abuse within the Serbian political landscape and indicated steps toward stricter controls on distribution.
Building on that context, Amnesty International’s latest inquiry disclosed new evidence of a separate incident involving Cellebrite’s sale and deployment of an attack chain capable of bypassing the lock screen on Android devices that are patched with the latest security updates. The chain targets core components of the device’s software stack, specifically weaknesses in the Linux kernel’s USB drivers, to gain unauthorized access and bypass the device’s lock mechanism. The compromised device in this case belonged to a Serbian student who had publicly criticized Serbian authorities, signaling that the surveillance operation targeted individuals involved in political expression. Amnesty’s investigators noted that the chain relies on exploiting a sequence of vulnerabilities in the kernel’s USB subsystem, allowing attackers with physical access to a locked Android phone to circumvent security and establish privileged control on the device. This finding deepens concerns about how state actors might instrumentalize commercial spyware tools to pursue political objectives beyond traditional investigative methods.
The report emphasizes that the exploit chain is not device-specific. Because it targets foundational Linux kernel USB drivers, the vulnerabilities could affect a broad array of devices and vendors that rely on the same kernel codebase, extending the potential risk well beyond a single phone model or brand. The implications extend to Linux computers and embedded Linux devices as well, though Amnesty notes there is no evidence to date that the same chain was adapted to target non-Android Linux systems. The researchers also identified a specific vulnerability tracked as CVE-2024-53104, which had already been patched earlier in February 2025 with the Android Security Bulletin. Two other vulnerabilities, CVE-2024-53197 and CVE-2024-50302, had been patched upstream in the Linux kernel but had not yet been integrated into Android’s Android Security Patch Level at the time of the investigation. Such patch dynamics underscore the lag between upstream kernel fixes and their deployment in Android mobile platforms, a gap that can leave devices exposed during the interim.
Forensic traces uncovered by Amnesty International suggest that after the targeted phone was unlocked, the attackers attempted to install an unnamed application. This behavior aligns with patterns previously observed in cases where NoviSpy spyware was installed on Cellebrite-compromised devices. The analysis also revealed that the attack employed USB peripherals during the early stages, with later stages showing repeated connections to the phone to facilitate kernel memory disclosure and grooming—techniques commonly used to escalate privileges and maintain persistence. Investigators inferred that the peripherals were specialized devices designed to emulate video or audio hardware, enabling a broader set of exploitative actions while the target device remained in contact with these foreign peripherals. The combination of hardware emulation and software exploitation illustrates a sophisticated approach that leverages physical access to introduce deep, stealthy modifications to the device’s memory space.
In its response, Google acknowledged awareness of the vulnerabilities and the associated exploitation risk before these reports emerged. The company stated that fixes had already been developed for Android and were shared with OEM partners in a partner advisory issued on January 18. Google also indicated that these CVEs would be included in future Android Security Bulletins and would be required by the Android Security Patch Level. The company reiterated a standard precaution: users should update their devices as soon as security patches or software updates become available. The evolving patch landscape—where kernel-level fixes reach Android devices only after additional vetting and integration—highlights the ongoing challenge of timely post-discovery mitigation in a rapidly evolving threat environment. This dynamic is particularly acute for users in regions where political risk intersects with digital security, including the ongoing protests in Belgrade and other demonstrations where devices may be used to coordinate, document, and communicate under the watchful eye of authorities.
The Serbian student at the center of the new findings maintains active involvement in ongoing student protests in Belgrade. While the incident underscores the risk that activists face from sophisticated spyware tools, it also raises broader questions about how to protect civil society actors from state-level surveillance while balancing legitimate security concerns with privacy and human rights. The February 2025 Android Security Bulletin’s patch rollout is a critical milestone in reducing exposure, but Amnesty International’s report emphasizes that vulnerabilities, once weaponized, can enable a chain of exploitation that persists across devices even after initial protections are put in place. The situation thus sits at the intersection of cybersecurity, human rights, and sovereign policy decisions, inviting a broader discussion about accountability for vendors, the governance of exploit markets, and the obligations of states to safeguard civil liberties in an age of digital surveillance.
Technical Analysis of the Exploit Chain
How the lock-screen bypass operates and why it matters
The core technical revelation centers on a chain of vulnerabilities that target the Linux kernel’s USB subsystem. By exploiting a sequence of weaknesses in USB drivers, attackers who gain physical access to a device can bypass the lock screen and attain elevated, privileged access on the Android device. This class of exploit is particularly alarming because it does not rely on social engineering or remote access; it requires physical interaction with the device and, in many cases, the presence of adversarial hardware during the attack sequence. The ability to defeat lock-screen protections on fully patched Android devices demonstrates that patching alone cannot always guarantee security against highly crafted attack chains that operate at the kernel level and leverage hardware interfaces.
The chain’s architecture implies a broad attack surface. While the immediate target is an Android device, the underlying vulnerabilities reside in the Linux kernel, a widely used core component across many platforms. The implications extend to Linux computers and embedded Linux systems, which could be at risk if similar driver vulnerabilities are exploited in different contexts. Although the current evidence focuses on Android, the mechanism’s generality raises concerns about cross-platform risk and the potential for misuse in other environments that rely on Linux-based kernel USB subsystems. It also underscores the need for rapid cross-vendor coordination between Google, device manufacturers, and the broader Linux community to ensure that fixes are consistently applied across the ecosystem.
The role of CVEs and patch dynamics
The vulnerabilities cited by Amnesty International include CVE-2024-53104, which had been patched in the February 2025 Android Security Bulletin. Two additional vulnerabilities—CVE-2024-53197 and CVE-2024-50302—had already been patched upstream in the Linux kernel but had not yet been incorporated into Android’s patch level at the time of the investigation. This patch dynamic points to a well-known challenge in the Android security landscape: upstream kernel fixes must pass through device manufacturers, OEMs, and carriers before they become part of the consumer update stream. The delay between upstream fixes and their Android integration creates a window of vulnerability that can be exploited by determined adversaries, especially in environments where devices are physically accessible to attackers or where security patch adoption is uneven due to device fragmentation, user behavior, or supply-chain realities.
From a defensive perspective, the advisory from Google indicates a commitment to disseminating fixes and ensuring that CVEs appear in future Android Security Bulletins. For enterprise and government users, this means monitoring patch levels and ensuring that devices meet the recommended SPL (Security Patch Level) requirements. It also underscores the importance of enterprise rollout planning and asset management to minimize the time devices spend unpatched. In the broader security discourse, these details highlight how even a robust patching regime can be undermined by segmentation in device ecosystems, delays in vendor-managed deployments, and the complexity of coordinating across multiple hardware configurations.
Forensic traces and what they reveal about the attack
Forensic findings from Amnesty International’s analysis reveal several telltale signs of the attack sequence. After the device was unlocked, investigators identified attempts to install an unknown application, behavior that aligns with known spyware deployment patterns, including those observed in NoviSpy campaigns tied to Cellebrite-related investigations. The presence of a new application installation following a successful bypass suggests an attempt to implant persistent tracking or data-exfiltration capabilities on the device. This pattern of behavior is significant because it points to a deliberate step beyond merely gaining access: it signals an intent to establish a foothold for ongoing surveillance and potential remote access.
Additionally, the investigation noted the use of USB peripherals in the early stages of the attack. The peripherals appeared to be connected to the phone in multiple phases, culminating in repeated connections during the later stages to disclose kernel memory and groom kernel memory as part of the exploitation. Analysts interpreted these peripherals as specialized devices emulating video or audio hardware to facilitate the exploitation process. This hardware-based approach illustrates how attackers leverage combined hardware-software tactics to achieve deeper levels of access, exploiting kernel-level weaknesses while manipulating peripheral interfaces to maintain control. The depth of these techniques underscores the sophistication of modern surveillance toolchains and their capacity to operate covertly on targeted devices.
The broader risk landscape and defensive priorities
Taken together, the technical analysis reveals a multi-faceted threat: a weaponized chain that leverages kernel-level USB driver vulnerabilities, physical access, and hardware emulation to bypass protections and install stealthy software. The risk is not isolated to a single device or user segment; rather, it implicates a wide range of devices that share Linux kernel USB architectures and, by extension, could potentially affect Linux-based desktops and embedded systems. The existence of such a chain compels security professionals, policymakers, and civil society advocates to reassess risk models for personal devices in politically tense environments. It also reinforces the need for rapid, coordinated disclosure and swift patch management, along with careful consideration of how surveillance tools are marketed, distributed, and monitored for misuse.
From a security operations perspective, the findings advocate for strengthening supply-chain resilience, enhancing device-level hardening of USB interfaces, and implementing strict access controls that minimize the likelihood of physical tampering. They also highlight the importance of comprehensive incident response planning: organizations and individuals must be prepared to detect unusual installation attempts, monitor for unexpected peripheral connections, and respond quickly when patches or advisories are issued. The intersection of these technical insights with human-rights concerns amplifies the urgency of responsible vendor stewardship and robust oversight mechanisms to prevent the weaponization of such tools against civil society and political dissenters.
Implications for Civil Society, Policy, and Security Strategy
Civil society under digital siege
The Serbian context cited by Amnesty International places civil society activists at particular risk in environments where authorities wield advanced surveillance capabilities. When state actors possess weaponized tools capable of defeating device security and implanting spyware, activists who rely on mobile devices for organizing, reporting, and communicating become disproportionately vulnerable. This vulnerability is amplified by the dual pressures of political activism and digital heterogeneity: different devices, operating system versions, and patch states create a mosaic of risk that can be exploited unevenly. The situation calls for enhanced awareness among activists about potential threats and a push for safer communication practices, device hygiene, and protective measures tailored to high-risk settings.
Accountability, governance, and the ethics of sale
Cellebrite’s decision to suspend sales to Serbia after the December report signals a degree of vendor accountability, but the continued presence of an attack chain in the wild raises questions about governance, licensing, and due diligence across the broader ecosystem. The ethics of selling powerful surveillance tools to any actor—whether state or private—remain a central concern in discussions about digital rights, privacy, and human rights. The intersection of commercial incentives and public safety obligations requires ongoing oversight, transparent disclosure about tool capabilities, and rigorous compliance with international norms regarding the export and use of spyware. These dynamics are particularly salient in regions where political authorities have narratives of national security that may align with aggressive surveillance practices, complicating the boundaries between legitimate law enforcement and civil rights violations.
The patch gap and the policy response
The patch-delay dynamic—where kernel-level fixes are introduced upstream but take time to be reflected in Android devices—highlights a structural challenge in protecting users. Policymakers and industry stakeholders must work toward reducing the time-to-remediate for critical vulnerabilities, especially those that enable privilege escalation and device-wide compromise. This could involve accelerated cross-vendor collaboration, standardized patching timelines, and clearer accountability for timely integration of kernel fixes into user devices. The policy conversation must also address the abuse potential of commercial exploit tools and establish frameworks for reporting, tracking, and mitigating misuse while preserving legitimate security research and investigative capabilities.
International implications and cross-border considerations
Although the incident centers on Serbia, the underlying technical dynamics have global relevance. The possibility that similar exploitation chains could affect devices across borders implies that many countries face comparable risks, regardless of their specific political context. This reality elevates the importance of international cooperation among governments, technology companies, civil society organizations, and security researchers to share best practices, coordinate vulnerability disclosures, and promote responsible usage standards for surveillance technologies. The situation underscores the need for robust human-rights frameworks that constrain state power, protect digital freedoms, and ensure that security tools are not leveraged in ways that undermine civic participation, journalistic work, or peaceful assembly.
Security Guidance for Android Users and End-User Safeguards
- Keep devices updated: Install the latest Android Security Bulletins and ensure that the February 2025 patch level (or the most recent patch level available) is applied. Patch management is a critical line of defense against kernel-level exploits that target USB drivers and other core components.
- Understand patch lifecycles: Recognize that upstream Linux kernel fixes may precede Android integration. Stay informed about advisories from device manufacturers and Google, and prioritize devices with timely security updates.
- Limit physical exposure: Be aware that high-risk exploits often require physical access. Avoid leaving devices unattended in public or high-risk environments where attacker-performed hardware connections could occur.
- Manage USB access: Evaluate settings that control USB access when the device is locked. Prefer prompts or permissions-based models for USB connections rather than automatic trust when the device is locked.
- Use trusted peripherals: Be cautious about unfamiliar USB devices or peripherals. Do not connect untrusted hardware to a phone that may be in a sensitive environment, particularly during protests, demonstrations, or investigative activities.
- Harden the device: Enable robust lock-screen protections, consider biometric and passcode combinations, and use device encryption where available. Maintain a layered security posture to make exploitation more difficult.
- Regularly audit installed apps: Periodically review installed applications for unknown or unexpected software, particularly after a device has undergone a security incident or unusual behavior.
- Employ additional safeguards: For activists and journalists, consider using secure, privacy-preserving communication tools, secure storage practices, and additional device hardening measures recommended by digital security professionals.
- Monitor official advisories: Stay attuned to official patch notices and guidance from reputable security organizations and device manufacturers, especially when new CVEs are disclosed that affect the kernel or USB subsystem.
- Avoid overreliance on any single defense: While patches mitigate known vulnerabilities, layered defenses—such as hardware security modules, enterprise management controls, and user education—provide a more resilient protection framework.
Broader Lessons and Path Forward
The convergence of exploit tooling, state surveillance, and civil society risk in this case illustrates a persistent vulnerability in the modern digital landscape: the dual-use nature of powerful security tools. When such tools are accessible to multiple actors with varying intentions, the potential for abuse grows, posing threats to privacy, freedom of expression, and political participation. The incident underscores the importance of continuous vigilance, rigorous oversight, and international collaboration to ensure that security technologies are deployed responsibly and that safeguards are in place to prevent misuse against ordinary citizens, human rights defenders, and protesters.
At the same time, the scenario reinforces the necessity for robust patch management and proactive security governance. It is essential for device manufacturers, software vendors, and platform providers to streamline the path from kernel-level fixes to consumer devices, minimizing the exposure window that attackers can exploit. The cross-cutting nature of the vulnerabilities also calls for more transparent conversations about the ethical implications of surveillance technologies, the responsibilities of vendors toward human rights, and the role of independent monitoring bodies in validating claims about state-sponsored or commercially facilitated surveillance campaigns.
Finally, the Serbian case, as documented by Amnesty International, serves as a reminder that digital security is inseparable from human rights and civic space. It highlights how online tools and physical devices alike can become instruments in broader political contests and the need for protective policies that preserve dissent, protect activists, and uphold the rights to freedom of expression, association, and assembly in the 21st century.
Practical Takeaways for Stakeholders
- For policymakers: Prioritize rapid, coordinated responses to newly disclosed vulnerabilities, strengthen oversight of surveillance technology exports, and consider binding norms that govern the sale and deployment of exploit tools.
- For device manufacturers and OS developers: Accelerate integration of upstream kernel fixes into Android distributions, improve transparency around patch timelines, and bolster protections against kernel-level exploit chains that leverage USB peripherals.
- For civil society and activists: Build awareness around digital security risks, adopt best-practice safety measures, and advocate for stronger protections and accountability mechanisms that prevent abuse of surveillance technologies against dissent.
- For researchers and security professionals: Continue independent assessments of exploit chains, publish findings responsibly to inform defenders, and collaborate across communities to enhance defensive capabilities while supporting legitimate security research.
Conclusion
The latest Amnesty International findings illuminate a troubling pattern: a sophisticated exploit chain, capable of bypassing Android’s lock screen, has been associated with state-linked surveillance concerns in Serbia. The incident underscores the fragility of security in the face of weaponized tools and highlights a broader ecosystem challenge, where patches, vendor practices, and political power intersect to shape risk for ordinary users and civil society alike. The evidence suggests that authorities have continued surveillance efforts in the aftermath of prior inquiries, even as calls for reform and accountability persist. While Google and other actors have acknowledged the vulnerabilities and committed to remediation, the incident reinforces the urgency of responsible stewardship, robust patch management, and comprehensive safeguards that protect privacy, civil liberties, and digital rights in an increasingly complex security landscape. As stakeholders across sectors respond—policymakers, industry players, researchers, and civil society alike—the goal remains clear: to curb misuse, accelerate protective measures, and ensure that security technologies bolster, rather than endanger, democratic participation and personal security.
