At least 14 members of Serbia’s civil society were targeted with advanced spyware earlier this year, a digital rights group says, in what it calls the largest documented wave of such infections in the country. The campaign was uncovered in August after Apple alerted users across 110 countries that they had likely been victims of mercenary spyware.
Forensic analysis by the Citizen Lab found at least one Serbian target had been hit with the NSO Group’s Pegasus spyware, which can give an attacker total access to a device. The Share Foundation, which identified those affected, said the list included members of a student movement that has protested President Aleksandar Vučić’s government since 2024. That movement emerged after a train station collapse and has become one of the largest student-led campaigns in Europe.
Share linked the infections’ timing to March’s local elections and suggested the operation may have served as a practice run for snap elections scheduled for October. “This is the largest documented wave of surveillance in Serbia so far,” said Andrijana Ristic, a policy adviser at Share. John Scott-Railton, a senior researcher at the Citizen Lab, added, “Our forensic findings, and this fresh wave of Apple threat notifications reveal that Serbia’s peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles.”
Some of the software used against students, including a program called NoviSpy, has previously been linked to Serbian authorities, though Share and the researchers do not say the government itself carried out every attack. Ana Brnabić, the parliamentary speaker and a senior figure in the ruling Serbian Progressive Party, denied the claims in an interview. “Absolutely not,” she said. “I do not believe a single word they’ve [students, Share] said.”
Targets described the intrusion as deeply invasive. Milica Popović, one of the students identified, called the attacks “cruel” and said, “Thinking that someone may have entered my private space without my knowledge made me feel so exposed.” She said the experience would not end the student movement. “If their intention was to frighten us, or make us stop, it will not work.”
The episode will sharpen scrutiny of surveillance tools as Serbia heads into a pivotal election period. NSO Group, the company behind Pegasus, began as an Israeli firm and is now under US ownership while attempting to reposition itself in international markets. The firm has been permanently barred by a US court from targeting WhatsApp users and Meta products, and it is not clear whether the Pegasus intrusions in Serbia exploited that messaging service. NSO was approached for comment.
