Spyware hits a broad swath of Serbian civil society
At least 14 Serbians have been caught in a spyware dragnet since December, with victims ranging from a sitting member of Parliament to student protesters who helped organize election efforts. Digital forensic researchers say the campaign appears timed to political events — local elections in March and a likely parliamentary vote this fall.
The SHARE Foundation, a Serbian digital rights group, launched its investigation after a dozen people came forward in August saying Apple had alerted them to possible state-sponsored hacking. In some cases, the alerts were justified: researchers found actual infections.
Two distinct types of spyware were identified on victims’ phones, according to the foundation’s report.
Pegasus and NoviSpy both found on victims’ devices
Experts at the Citizen Lab at the University of Toronto confirmed that one student protester’s phone was infected with zero-click Pegasus spyware between December 2025 and January 2026. Zero-click means no interaction from the victim was needed — no rogue link tapped, no malicious attachment opened.
Amnesty International, which peer-reviewed the SHARE Foundation’s findings, verified that a newer Android spyware called NoviSpy was used in at least two cases. Researchers are still examining 11 more phones whose owners received Apple threat notifications.
Donncha Ó Cearbhaill, who heads Amnesty’s Security Lab, told Recorded Future News the new NoviSpy variant “appears to have been updated to avoid detection.”
A chilling detail: texts read live on TV
One confirmed NoviSpy victim had text messages read aloud on a Serbian television network known to be friendly with the ruling party, the SHARE Foundation said. That detail underscores how surveillance can feed directly into propaganda.
Pattern of repression, or “trivial sensationalism”?
Ó Cearbhaill framed the spyware as one piece of a larger puzzle. “Combined with the excessive use of force against protesters, arbitrary arrests and unfounded criminal and misdemeanor charges, as well as vicious smear campaigns targeting individuals involved or perceived to support the anti-government protests, digital surveillance is yet another element of a broader pattern of systemic repression of critical voices,” he said.
Serbian authorities deny the allegations. The country’s intelligence agency, the BIA, dismissed the findings as “nothing more than trivial sensationalism,” adding that the accusations “clearly indicate the true intentions of the individuals and organisations making them, namely, acting in the interests of certain foreign intelligence services and pressure groups.”
Notably, the spyware activity tracked with the March local elections, which student protesters were deeply involved in. They were pushing to oust the ruling party, which critics describe as increasingly authoritarian.
Serbia has form when it comes to phone hacking
This isn’t a first for Serbia. The country has previously been caught targeting protesters, journalists and dissidents with both Pegasus and NoviSpy.
- In March 2025, Amnesty said its forensic researchers found two investigative journalists in Serbia had been targeted with Pegasus.
- A month earlier, Amnesty reported that Cellebrite — whose phone-breaking software lets governments extract data from devices — cut ties with Serbia after an Amnesty report documented NoviSpy being used against dissidents and journalists whose phones were taken while in government custody.
Police never asked detainees for their passwords in those cases, Amnesty said. Instead, they used Cellebrite to break in, then implanted the spyware.
The key difference between the two spyware types: NoviSpy requires physical access to the phone, while Pegasus can slip in remotely with zero interaction. That’s why many NoviSpy infections in Serbia have been discovered only after victims were detained and their phones confiscated during questioning.
NSO Group’s decade of promises, same abuses
John Scott-Railton, a Citizen Lab researcher involved in the Pegasus confirmation, pointed to a grim continuity. “Ten years ago, we found Pegasus spyware’s first target, pro-democracy campaigner Ahmed Mansour and he’s still jailed today,” he said. “Today, it’s Serbian students campaigning for democracy.”
“NSO has spent a decade promising reform, lobbying and shuffling ownership structures, and yet the product and the abuses haven’t changed,” Scott-Railton added. The NSO Group did not respond to a request for comment.
Both Pegasus and NoviSpy give operators extraordinary access — photos, contacts, messages, files, and even the ability to switch on microphones to hear conversations happening near the phone, not just on it.
“They are ready to use whatever it takes”
Ognjen Rašić, a third-year student and protester whose phone is still under forensic study, believes he was likely hit with Pegasus. He’s never been in police custody, which a NoviSpy attack would likely require.
Rašić has protested peacefully against the government for years and joined a student election-preparation team about a year ago. The potential infection unsettles him — especially the microphone capability. “The spyware is a strong indicator that our government is very afraid of us,” he said. “They are ready to use whatever it takes to sabotage us because we’re currently the strongest and the most influential political force in Serbia.”
The March elections were plagued by violence and irregularities, he said. Still, he and fellow protesters are pressing on, aiming to win in the parliamentary elections expected this fall.
“I want to send a clear message that I am not afraid and that my colleagues are not afraid,” Rašić said. “We want justice, and I think the most important message is that students will win.”
An MP steps forward
On Wednesday, opposition parliamentarian Radomir Lazović of the Green-Left Front revealed his phone was among the 14 targeted. Forensic work to determine whether the attack succeeded is ongoing, per the SHARE Foundation.
Lazović called on the European Commission in March to act against Serbian President Aleksandar Vučić over rights abuses. The attacks on him and the students show “how [the government] are slipping into some sort of, I don’t know, dictatorship,” he said.
“They want to control the political opponents of the ruling party, which tells you what atmosphere we, as an opposition, are actually working in,” Lazović added. “If they are controlling us, if they’re monitoring us, and they’re tapping our phones and so on, it’s really hard to have any kind of meaningful opposition working in Serbia.”
Ó Cearbhaill warned that such attacks tend to spike around heightened political moments. With early parliamentary elections likely in October, he said, “we are increasingly concerned about the safety of student protesters and civil society in general.”
CyberSecurity8 months ago
How To6 months ago
How To5 months ago
How To6 months ago
How To5 months ago
How To7 months ago
How To6 months ago