Serbia spyware scandal: 14 activists and students targeted

spyware Pegasus NoviSpy digital surveillance Serbia

Forensic investigations by the SHARE Foundation, Citizen Lab, and Amnesty International have documented a major surveillance campaign in Serbia. At least 14 individuals, including student activists, civil society members, and opposition politicians, were targeted with advanced spyware.

Technical analysis confirmed that at least one iPhone was infected with NSO Group’s Pegasus spyware via a zero-click iMessage exploit, which requires no user interaction. Other devices were found to be infected with software similar to NoviSpy, a domestic surveillance tool. The attacks reportedly coincided with the period surrounding the March 2026 local elections.

Serbian government officials, including Parliament Speaker Ana Brnabić, have denied involvement in illegal spying. The SHARE Foundation and student protesters have called for international investigations, while some European Parliament members have urged the European Commission to freeze EU funding to Serbia in response to these human rights concerns.

Entities

Aleksandar Vučić · Amnesty International · Ana Brnabić · Apple · Citizen Lab · NSO Group · Pegasus · SHARE Foundation · Šer Foundation

Claims

What the coverage asserts, and how many sources carry each claim.

[● 18 SOURCES] The identified spyware attacks coincided with the period surrounding local elections in Serbia. 444.hu · www.dagensps.se · telex.hu · www.masina.rs · www.dan.co.me · +10 more
[● 5 SOURCES] Serbian Parliament Speaker Ana Brnabić denied that the state was involved in spying on student protesters. beta.rs · naslovi.net · www.danas.rs · vojvodjanskireporter.rs
[● 22 SOURCES] At least 14 members of civil society in Serbia, including student activists and opposition politicians, were targeted by advanced spyware. www.masina.rs · 444.hu · www.dagensps.se · www.dan.co.me · telex.hu · +14 more
[● 15 SOURCES] Apple issued warnings to iPhone users in August regarding potential state-sponsored spyware attacks. 444.hu · www.dagensps.se · www.dan.co.me · telex.hu · www.vecernji.ba · +8 more
[● 14 SOURCES] At least two other devices were found to be infected with software similar to NoviSpy, a domestic surveillance tool. www.dagensps.se · www.dan.co.me · www.vecernji.ba · www.portalanalitika.me · prv.mk · +8 more
[● 10 SOURCES] One device was infected with a zero-click version of Pegasus, requiring no user interaction to install. www.dan.co.me · www.vecernji.ba · www.srpskadijaspora.info · verige.net · www.portalanalitika.me · +3 more
[● 13 SOURCES] NSO Group stated that it only sells its spyware products to government institutions. www.dagensps.se · www.vecernji.ba · 444.hu · www.srpskadijaspora.info · verige.net · +6 more
[● 16 SOURCES] Forensic analysis by Citizen Lab and Amnesty International confirmed the presence of Pegasus spyware on at least one targeted device. 444.hu · www.dan.co.me · telex.hu · www.vecernji.ba · www.srpskadijaspora.info · +8 more