John Scott-Railton is a leading expert on spyware, phishing, and information operations, with a global reputation for exposing sophisticated threats. As Senior Researcher at the Citizen Lab he leads the Targeted Threats team, collaborating with at-risk individuals and partners around the world to expose abuses and drive policy change. For more than a dozen years he has worked on collaborative investigations tracking and exposing digital attacks targeting people because of who they are, what they do, or what they say.
He is a regular expert voice in conversations about these topics, and has also testified to lawmakers in the U.S., Italy, Poland and the European parliament on the threats posed by spyware proliferation to national security and human rights.
He was the Founding Editor of the Security Planner which provides personalized expert security advice. He has also worked on ensuring connectivity in conflicts, including ensuring the free and secure flow of information during wartime. For example, he developed the Voices Projects, which helped bypass internet shutdowns in Egypt and Libya. He is a past fellow at Google Ideas / Jigsaw at Alphabet where he worked on products like the Phishing Quiz.
Connect
Publications
Targeting Democracy
Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures
In collaboration with the SHARE Foundation, we found with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade, and prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026. Additionally, we note that Rade Bajić, who, as a prosecutor, investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification. These notifications are high-confidence indicators of targeting with mercenary spyware such as Pegasus. Our investigations into these cases are ongoing.
Exposing AdFection Executive Summary
This is an executive summary for our report “Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.”
BlackCore’s Influence Operations for Hire
In this research note, we examine the digital infrastructure of BlackCore, an Israeli influence-for-hire company. We describe how we identified a BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.
