Amnesty International revealed that two 17-year-olds are among those at risk of being sentenced to death in Iran for involvement in January’s protests, calling for an immediate halt to the executions
Amnesty International has claimed that minors are among 30 people at risk of execution amid expedited trials connected to Iranian protests that took place in January 2026, according to a report published on Friday.
The Amnesty report reveals that among the 30 individuals arrested, eight have been sentenced to death, including one 18-year-old and a 19-year-old.
In a statement addressing the pending executions, Amnesty said, “The Iranian authorities must immediately halt all plans to execute eight individuals sentenced to death after being convicted of committing offences during the January 2026 nationwide protests.”
These 30-some individuals, including two 17-year-olds, are currently undergoing or awaiting trial proceedings and are at risk of receiving the death penalty as their trials proceed, according to Amnesty. Their charges include a variety of offenses against the regime, such as arson and connections to the death of a security officer.
These proceedings are reportedly tainted by numerous significant violations of the right to a fair trial.
Confessions reportedly extracted through torture
Such violations include allegations of confessions obtained through torture, denial of access to legal representation during the investigation phase, and refusal to recognize independent legal counsel appointed by the families of the accused for the trial.
According to Amnesty, some individuals sustained severe beatings while being pressured to confess to the charges against them. One individual was reportedly forced to confess after interrogators placed a gun in his mouth.
Amnesty also stated it believes that the actual number of individuals at risk of receiving the death penalty in Iran is much higher than the figures officially reported by the Iranian government. Iranian officials have arrested thousands of protesters in connection with the uprising and have repeatedly threatened to impose ‘the maximum punishment’ (death penalty) without delay.
‘Disregard for the right to life’
Diana Eltahawy, the Deputy Regional Director for the Middle East and North Africa at Amnesty International, made a statement about the upcoming executions, asserting that “the Iranian authorities are once again demonstrating their deep disregard for the right to life and justice by threatening expedited executions and imposing death sentences through fast-tracked trials, just weeks after arrests. By weaponizing the death penalty, they aim to instill fear and suppress the spirit of a population that is demanding fundamental change.”
She continued, “Children and young adults form the bulk of those caught in the machinery of state repression following the January protests, denied access to effective legal representation and subjected to torture or other ill-treatment and incommunicado detention to extract forced ‘confessions’. The international community must take coordinated global action, pressuring the Iranian authorities to stop using the court system as a conveyor belt for executions.”
Ironically, Gibson used to work at companies that developed exactly the kind of spyware that could trigger such a notification. Still, he was shocked that he received a notification on his own phone. He called his father, turned off and put his phone away, and went to buy a new one.
“I was panicking,” he told TechCrunch. “It was a mess. It was a huge mess.”
Gibson is just one of an ever-increasing number of people who are receiving notifications from companies like Apple, Google, and WhatsApp, all of which send similar warnings about spyware attacks to their users. Tech companies are increasingly proactive in alerting their users when they become targets of government hackers, and in particular those who use spyware made by companies such as Intellexa, NSO Group, and Paragon Solutions.
But while Apple, Google, and WhatsApp alert, they don’t get involved in what happens next. The tech companies direct their users to people who could help, but at which point the companies step away.
This is what happens when you receive one of these warnings.
Warning
You have received a notification that you were the target of government hackers. Now what?
First of all, take it seriously. These companies have reams of telemetry data about their users and what happens on both their devices and their online accounts. These tech giants have security teams that have been hunting, studying, and analyzing this type of malicious activity for years. If they think you have been targeted, they are probably right.
It’s important to note that in the case of Apple and WhatsApp notifications, receiving one doesn’t mean you were necessarily hacked. It’s possible that the hacking attempt failed, but they can still tell you that someone tried.
A photo showing the text of a threat notification sent by Apple to a suspected spyware victim (Image: Omar Marques/Getty Images)
In the case of Google, it’s most likely that the company blocked the attack, and is telling you so you can go into your account and make sure you have multi-factor authentication on (ideally a physical security key or passkey), and also turn on its Advanced Protection Program, which also requires a security key and adds other layers of security to your Google account. In other words, Google will tell you how to better protect yourself in the future.
In the Apple ecosystem, you should turn on Lockdown Mode, which switches on a series of security features that makes it more difficult for hackers to target your Apple devices. Apple has long claimed that it has never seen a successful hack against a user with Lockdown Mode enabled, but no system is perfect.
This advice includes keeping your devices’ operating systems and apps up-to-date; switching on Apple’s Lockdown Mode, and Google’s Advanced Protection for accounts and for Android devices; be careful with suspicious links and attachments; to restart your phone regularly; and to pay attention to changes in how your device functions.
Contact Us
Have you received a notification from Apple, Google, or WhatsApp about being targeted with spyware? Or do you have information about spyware makers? We would love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.
Reaching out for help
What happens next depends on who you are.
There are open source and downloadable tools that anyone can use to detect suspected spyware attacks on their devices, which requires a little technical knowledge. You can use the Mobile Verification Toolkit, or MVT, a tool that lets you look for forensic traces of an attack on your own, perhaps as a first step before looking for assistance.
If you don’t want or can’t use MVT, you can go straight to someone who can help. If you are a journalist, dissident, academic, or human rights activist, there are a handful of organizations that can help.
If you are a journalist, Reporters Without Borders also has a digital security lab that offers to investigate suspected cases of hacking and surveillance.
Outside of these categories of people, politicians or business executives, for example, will have to go elsewhere.
If you work for a large company or political party, you likely have a competent (hopefully!) security team you can go straight to. They may not have the specific knowledge to investigate in-depth, but in that case they probably know who to turn to, even if Access Now, Amnesty, and Citizen Lab cannot help those outside of civil society.
Otherwise, there aren’t many places executives or politicians you can turn to, but we have asked around and found the ones below. We can’t fully vouch for any of these organizations, nor do we endorse them directly, but based on suggestions from people we trust, it’s worth pointing them out.
Perhaps the most well known of these private security companies is iVerify, which makes an app for Android and iOS, and also gives users an option to ask for an in-depth forensic investigation.
Matt Mitchell, a well-regarded security expert who’s been helping vulnerable populations protect themselves from surveillance has a new startup, called Safety Sync Group, which offers this kind of service.
Jessica Hyde, a forensic investigator with experience in the public and private sectors, has her own startup called Hexordia, and offers to investigate suspected hacks.
Mobile cybersecurity company Lookout, which has experienceanalyzinggovernmentspyware from around the world, has an online form that allows people to reach out for help to investigate cyberattacks involving malware, device compromise, and more. The company’s threat intelligence and forensics teams may then get involved.
Then, there’s Costin Raiu, who heads TLPBLACK, a small team of security researchers who used to work at Kaspersky’s Global Research and Analysis Group, or GReAT. Raiu was the unit’s head when his team discovered sophisticated cyberattacks from elite government hacking teams from the United States, Russia, Iran, and other countries. Raiu told TechCrunch that people who suspect they’ve been hacked can email him directly.
Investigation
What happens next depends on who you go to for help.
Generally speaking, the organization you reach out to may want to do an initial forensic check by looking at a diagnostic report file that you can create on your device, which you can share with the investigators remotely. At this point, this doesn’t require you to hand over your device to anyone.
This first step may be able to detect signs of targeting or even infection. It may also turn out nothing. In both cases, the investigators may want to dig deeper, which will require you to send in a full backup of your device, or even your actual device. At that point, the investigators will do their work, which may take time because modern government spyware attempts to hide and delete its tracks, and will tell you what happened.
Unfortunately, modern spyware may not leave any traces. The modus operandi these days, according to Hassan Selmi, who leads the incident response team at Access Now’s Digital Security Helpline, is a “smash and grab” strategy, meaning that once spyware infects the target device, it steals as much data as it can, and then tries to remove any trace and uninstall itself. This is assumed as the spyware makers trying to protect their product and hide its activity from investigators and researchers.
If you are a journalist, a dissident, an academic, a human rights activist, the groups who help you may ask if you want to publicize the fact that you were attacked, but you’re not required to do so. They will be happy to help you without taking public credit for it. There may be good reasons to come out, though: To denounce the fact that a government targeted you, which may have the side effect of warning others like you of the dangers of spyware; or to expose a spyware company by showing that their customers are abusing their technology.
We hope you never get one of these notifications. But we also hope that, if you do, you find this guide useful. Stay safe out there.
The Thailand-Cambodia conflict reportedly has innocent civilians in its crossfire
Thailand is targeting suspected scam centers where trafficked persons work
Thousands of people suspected to be human trafficking victims who have been forced to work in slave-like conditions in Cambodia along the Thailand border have been caught in the crossfire of the ongoing conflict.
A casino in Cambodia near the Thailand border, suspected to be a scam center, is bombed by Thai F-16 fighter jets. Human trafficking victims are said to be in the conflict’s crossfire. (Image: Royal Thai Military)
Thailand has targeted border casinos in Cambodia that the Thai army claims have been retrofitted to serve as arsenals and firing positions for the Royal Cambodian Armed Forces. Thailand has bombed or struck at least four casinos in Cambodia just across the border.
The territorial dispute, which has endured for more than a century, escalated into armed conflict earlier this year after Thai soldiers in February prevented Cambodian tourists from singing their national anthem at the Prasat Ta Muen Thom, an ancient temple along the border. The incident resulted in the death of a Cambodian soldier.
A leaked phone call between Paetongtarn Shinawatra, then the prime minister of Thailand, and Hun Sen, the most powerful person in Cambodia, recorded the prime minister blaming her own army for the February incident. The informal conversation that was made public led to Shinawatra’s impeachment and intensified tensions between the two sides.
Casino Scam Centers
While there are many casinos on the Cambodia side of the Thai-Cambodia border, the United Nations says the casinos have also served as scam centers where an estimated 100,000 victims of human trafficking have been forced to perpetrate online scams in what’s believed to be a multibillion-dollar industry.
Amnesty International, an international human rights organization based in London, says the Cambodian government has allowed slavery and torture to “flourish inside hellish scamming compounds.” The organization has managed to visit 52 scamming compounds in Cambodia, with many of the buildings previously serving as casinos and hotels that were repurposed by criminal gangs from China.
Most victims had been lured to Cambodia by deceptive job advertisements posted on social media sites such as Facebook and Instagram. After being trafficked, survivors said they were forced to contact people using social media platforms and begin conversations aimed at defrauding them. These included fake romances or investment opportunities, selling products that would never be delivered, or building trust with victims before financially exploiting them, known as ‘pig-butchering,’” Amnesty reports.
“Our findings reveal a pattern of state failures that have allowed criminality to flourish and raise questions about the government’s motivations,” said Amnesty International’s Regional Research Director Montse Ferrer.
UN Advisory
The United Nations confirmed this week that civilians and human trafficking victims in Cambodia remain at risk, and some have likely been killed in the Thailand-Cambodia conflict.
Casino complexes and suspected scam centers in Cambodia have reportedly been hit,” the UN advised.
“I am alarmed by reports that areas around villages and cultural sites are being struck by fighter jets, drones, and artillery. “Under international humanitarian law, it is very clear that protection of civilians and civilian infrastructure is paramount,” added Volker Türk, the UN’s high commissioner for human rights.
Iranian authorities have executed over 1,000 people so far this year, human rights watchdog Amnesty International said on Friday.
This was the highest number of yearly executions in Iran recorded by Amnesty in at least 15 years, the organization reported.
“The ongoing escalation of executions in Iran has reached horrific proportions as the Iranian authorities continue to systematically weaponize the death penalty as a tool of repression and to quash dissent while displaying a chilling assault on the right to life,” said Heba Morayef, regional director for the Middle East and North Africa at Amnesty International.
Advertisement
Advertisement
Advertisement
Advertisement
At the end of August, the United Nations observed 841 executions since the beginning of the year, a sharp increase in executions compared to previous years. According to UN figures, there were at least 975 executions in total in 2024.
During the war against Israel in June and after a ceasefire came into force, Iran's security authorities cracked down on alleged collaborators with the country's arch-enemy. Iranian media reported a number of executions for alleged espionage for Israel.
MADRID — Spanish prosecutors have dropped their investigation into the deaths of more than 20 migrants last June at the border between Morocco and the Spanish enclave city of Melilla, saying in a statement Friday they found no evidence of criminal misconduct by Spanish security forces.
Prosecutors said they spent six months investigating what happened when hundreds of migrants — some estimates say around 2,000 — stormed the Melilla border fence in northwest Africa from the Moroccan side in an attempt to reach European soil. At least 23 migrants were officially reported dead, though human rights groups say the number was higher.
The Spanish prosecutors said “it cannot be concluded that the conduct of the (Spanish) security officers involved increased the threat to the life and wellbeing of the immigrants, so no charge of reckless homicide can be brought.”
The migrants were “hostile and violent,” the prosecutors’ statement said.
Hundreds of men, some wielding sticks, climbed over the fence from Moroccan territory and were corralled into a border crossing area. When they managed to break through the gate to the Spanish side, a stampede apparently led to the crushing of many people.
Moroccan police launched tear gas and beat men with batons, even when some were prone on the ground. Spanish guards surrounded a group that managed to get through before apparently sending them back.
The clash ended with African men, clearly injured or even dead, piled on top of one another while Moroccan police in riot gear looked on.
The Spanish prosecutors said that “at no point did (Spanish) security officers have reason to believe that there were people at risk who required help.”
However, the prosecutors faulted some security officers who threw rocks at the immigrants, recommending disciplinary procedures against them.
Amnesty International said earlier this month that the handling of the investigation by Spain and Morocco, which has remained mostly silent on the matter, “smacks of a cover-up and racism.”
TORONTO — The Canadian branch of Amnesty International said Monday it was the target of a cyber attack sponsored by China.
The human rights organization said it first detected the breach on Oct. 5, and hired forensic investigators and cybersecurity experts to investigate.
Ketty Nivyabandi, Secretary General of Amnesty International Canada, said the searches in their systems were specifically and solely related to China and Hong Kong, as well as a few prominent Chinese activists. The hack left the organization offline for nearly three weeks.
U.S. cybersecurity firm Secureworks said “a threat group sponsored or tasked by the Chinese state” was likely behind the attack because there was no attempt to monetize the access, the nature of the searches, the level of sophistication and the use of specific tools which are distinctive of China-sponsored actors.
Nivyabandi encouraged activists and journalists to update their cybersecurity protocols in light of it.
“As an organization advocating for human rights globally, we are very aware that we may be the target of state-sponsored attempts to disrupt or surveil our work. These will not intimidate us and the security and privacy of our activists, staff, donors, and stakeholders remain our utmost priority,” Nivyabandi said.
Amnesty is among organizations that support human rights activists and journalists targeted by state actors for surveillance. That includes confirming cases of activists’ and journalists’ cell phones being infected with Pegasus spyware, which turns the devices into real-time listening devices in addition to copying their contents.
In August, the cybersecurity firm Recorded Future listed Amnesty and the International Federation for Human Rights among organizations that Chinese hackers were targeting through password-stealing schemes designed to harvest credentials. It called that particularly concerning given the Chinese state’s “reported human rights abuses in relation to Uyghurs, Tibetans and other ethnic and religious minority groups.”
Amnesty has raised alarms about a system of internment camps in China that swept up a million or more Uyghurs and other ethnic minorities, according to estimates by experts. China, which describes the camps as vocational training and education centers to combat extremism, says they have been closed. The government has never publicly said how many people passed through them.
China’s embassy in Ottawa did not immediately respond to a message seeking comment.
————
AP writer Frank Bajack in Boston contributed to this report.
Up to 10 people, including children, are feared to have been killed Friday in a crackdown on protests by Iranian security forces in the southeast of the country, human rights watchdog Amnesty International said.
In several Twitter posts Friday, Amnesty said security forces had fired live ammunition at “peaceful protesters from the rooftops of the governor’s office and several other buildings” in the city of Khash in Sistan and Baluchestan province.
The province, neighboring Pakistan and Afghanistan, is home to members of the long-oppressed predominantly Sunni Muslim Baluch ethnic minority and has a history of unrest.
The violence Friday comes amid nationwide protests against the death of Mahsa Amini, a 22-year-old Kurdish women who died after being detained by morality police in Tehran.
Large-scale demonstrations have also taken place recently in Zahedan, the state capital of Sistan and Baluchestan, following the alleged rape of a Baluch girl by the police chief.
Authorities removed the head of police in Zahedan last week, but protests continued and on Thursday, a high ranking Shia cleric was shot dead by masked gunmen in Zahedan, according to state news agency IRNA.
According to state media and activists, protests against authorities turned violent Friday in several cities across southeast Iran, including Khash. One video from the city posted by state media showed plumes of smoke rising from a building.
In its reports, Amnesty cited witnesses and footage it had obtained from various sources.
The group said it was “gravely concerned about further bloodshed amid internet disruptions and reports of authorities bringing more security forces to Khash from Zahedan.”
“Iran’s authorities must immediately rein in security forces. Member states of the UN must immediately raise concerns with Iran’s ambassadors and support the establishment of an independent investigative mechanism by the UN Human Rights Council,” Amnesty said.
The Coordinating Council of Iranian Teachers’ Trade Associations (CCITTA) also tweeted on Friday that at least 16 protesters were killed, and dozens more were injured after Iranian security forces opened fire on protesters in Khash.
CNN cannot independently verify the death tolls provided by either Amnesty or the CCITTA. A precise death toll is impossible for those outside Iran’s government to confirm. Numbers vary by opposition groups, international rights organizations, and local journalists.
A video shared with CNN by the activist outlet IranWire from Khash appears to show several protesters wounded and unconscious on the ground, after loud gunshots rang out in the background.
Meanwhile, the country’s semi-official Fars News Agency posted images on Twitter showing charred cars and damaged buildings, with a caption that blamed the damage on “rioters.”
During Friday’s “unrest in Khash, several people were killed and injured,” Fars said in the tweet.
“The governorate, the building of Jihad Agriculture and several other government buildings, several kiosks and police cars, people’s private cars, and almost all banks were set on fire by rioters,” Fars added.
Fars claimed the protests in Khash took place after Friday prayers at a Sunni mosque in the area.
DUBAI, United Arab Emirates — Leaked government documents show that Iran ordered its security forces to “severely confront” antigovernment demonstrations that broke out earlier this month, Amnesty International said Friday.
The London-based rights group said security forces have killed at least 52 people since protests over the death of a woman detained by the morality police began nearly two weeks ago, including by firing live ammunition into crowds and beating protesters with batons.
It says security forces have also beaten and groped female protesters who remove their headscarves to protest the treatment of women by Iran’s theocracy.
The state-run IRNA news agency meanwhile reported renewed violence in the city of Zahedan, near the borders with Pakistan and Afghanistan. It said gunmen opened fire and hurled firebombs at a police station, setting off a battle with police.
It said police and passersby were wounded, without elaborating, and did not say whether the violence was related to the antigovernment protests. The region has seen previous attacks on security forces claimed by militant and separatist groups.
Videos circulating on social media showed gunfire and a police vehicle on fire. Others showed crowds chanting against the government. Video from elsewhere in Iran showed protests in Ahvaz, in the southwest, and Ardabil in the northwest.
The death in custody of Mahsa Amini, who was detained for allegedly wearing the mandatory Islamic headscarf too loosely, has triggered an outpouring of anger at Iran’s ruling clerics.
Her family says they were told she was beaten to death in custody. Police say the 22-year-old Amini died of a heart attack and deny mistreating her, and Iranian officials say her death is under investigation.
Iran’s leaders accuse hostile foreign entities of seizing on her death to foment unrest against the Islamic Republic and portray the protesters as rioters, saying a number of security forces have been killed.
Amnesty said it obtained a leaked copy of an official document saying that the General Headquarters of the Armed Forces ordered commanders on Sept. 21 to “severely confront troublemakers and anti-revolutionaries.” The rights group says the use of lethal force escalated later that evening, with at least 34 people killed that night alone.
It said another leaked document shows that, two days later, the commander in Mazandran province ordered security forces to “confront mercilessly, going as far as causing deaths, any unrest by rioters and anti-Revolutionaries,” referring to those opposed to Iran’s 1979 Islamic Revolution, which brought the clerics to power.
“The Iranian authorities knowingly decided to harm or kill people who took to the streets to express their anger at decades of repression and injustice,” said Agnes Callamard, Amnesty International’s Secretary General.
“Amid an epidemic of systemic impunity that has long prevailed in Iran, dozens of men, women and children have been unlawfully killed in the latest round of bloodshed.”
Amnesty did not say how it acquired the documents. There was no immediate comment from Iranian authorities.
Iranian state TV has reported that at least 41 protesters and police have been killed since the demonstrations began Sept. 17. An Associated Press count of official statements by authorities tallied at least 14 dead, with more than 1,500 demonstrators arrested.
The New York-based Committee to Protect Journalists said Thursday that at least 28 reporters have been arrested.
Iranian authorities have severely restricted internet access and blocked access to Instagram and WhatsApp, popular social media applications that are also used by the protesters to organize and share information.
That makes it difficult to gauge the extent of the protests, particularly outside the capital, Tehran. Iranian media have only sporadically covered the demonstrations.
Iranians have long used virtual private networks and proxies to get around the government’s internet restrictions. Shervin Hajipour, an amateur singer in Iran, recently posted a song on Instagram based on tweets about Amini that received more than 40 million views in less than 48 hours before it was taken down.
