Four Kenyan filmmakers fell victim to sophisticated espionage when FlexiSPY software was secretly installed on their devices while they were in police custody, according to a forensic analysis conducted by the University of Toronto's Citizen Lab
See also: Iranian hackers distribute DCHSpy spyware via fake VPN apps
The incident occurred around May 21, 2025, after authorities seized the devices during arrests linked to charges surrounding the BBC documentary “Blood Parliament.” The filmmakers—MarkDenver Karubiu, Bryan Adagala, Nicholas Wambugu , and Christopher Wamae—were arrested on May 2 at a Nairobi studio on charges of publishing false information. Although they were released without charge the next day, their electronic devices remained in police custody until July 10, providing a window for the unauthorized installation of the spyware.
CPJ analysts noted that the installation of FlexiSPY constitutes a significant violation of journalistic privacy and security. The commercially available surveillance tool gives operators full access to victims’ digital communications, including real-time monitoring of messages, emails, and social media activity. Senior researcher John Scott-Railton stressed that the spyware provides “silent, covert access to all manner of private businesses and information related to their journalism.”
See also: New Spyware Vendor Report: Targets & Infection Chains
FlexiSPY is marketed as a monitoring solution for parents and employers, touting capabilities that extend far beyond basic surveillance. The software can record phone calls, track device locations and website visits, log passwords, download photos and videos, and even turn on device microphones to listen in on the environment. This extensive monitoring capability is particularly worrisome when used against journalists and media professionals.
FlexiSPY spyware exhibits sophisticated persistence mechanisms designed to maintain long-term access to compromised devices. Once installed, the malware operates silently in the background, continuously transmitting data to remote servers while evading detection by standard security measures. The software’s architecture allows it to survive device reboots and resist removal attempts through stealthy system-level integration.
The software’s monitoring capabilities extend to encrypted messaging platforms, potentially compromising secure communications that journalists rely on to protect their sources. By intercepting data before encryption at the application level, FlexiSPY can capture sensitive information that would otherwise remain protected. This functionality poses particular risks for investigative journalists who depend on confidential communications with sources and colleagues.
See also: Android spyware Catwatchful leaks 62,000 user logins
The incident highlights growing concerns about state surveillance of media professionals and the weaponization of commercial spyware against press freedom advocates worldwide.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
