Large group of Serbian opposition, activist figures targeted with spyware

At least 14 Serbians have been targeted with advanced spyware since December, with victims including a member of Parliament, a local opposition politician and student protesters, according to digital forensic researchers.

The Serbian digital freedoms organization the SHARE Foundation set out to confirm the targeting and, in some cases, infections after 12 people contacted them saying they had received Apple threat notifications in August.

The timing of the spyware targeting and infections coincided with local elections held in March, the SHARE Foundation said in its report. The student protesters were active in election organizing in an effort to oust the increasingly authoritarian ruling party.

Two different types of spyware were found on the victims' phones, researchers found. 

Experts at the Citizen Lab confirmed one of the student protesters’ phones was infected with zero-click Pegasus spyware between December 2025 and January 2026, according to its report on the probe.

Amnesty International, which conducted a peer review of the SHARE Foundation’s findings, confirmed that a new form of Android spyware known as NoviSpy was used in at least two cases.

Forensic research is ongoing for 11 additional phones whose owners were alerted by Apple to likely malicious activity.

One of the confirmed NoviSpy victims’ text messages were read live on a Serbian television network friendly with the ruling party, the SHARE Foundation said.

The new NoviSpy variant “appears to have been updated to avoid detection,” Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, told Recorded Future News.

“Combined with the excessive use of force against protesters, arbitrary arrests and unfounded criminal and misdemeanor charges, as well as vicious smear campaigns targeting individuals involved or perceived to support the anti-government protests, digital surveillance is yet another element of a broader pattern of systemic repression of critical voices,” he said.

“These attacks tend to spike around heightened political moments and we are increasingly concerned about the safety of student protesters and civil society in general in the lead up to the early parliamentary elections, which are likely to take place in October.”

Serbian authorities reportedly denied the accusations, with the country’s intelligence agency, known as BIA, calling the claims, “nothing more than trivial sensationalism.”

“The content of these allegations clearly indicates the true intentions of the individuals and organisations making them, namely, acting in the interests of certain foreign intelligence services and pressure groups,” the BIA said.

A history of digital repression

Serbia has previously been found targeting protesters, journalists and dissidents with both Pegasus and NoviSpy spyware. 

In March 2025, Amnesty International said its forensic researchers had found two investigative journalists in Serbia  were targeted with Pegasus.

A month earlier, Amnesty reported that Cellebrite, whose software allows governments to break into and extract data from phones, cut ties with Serbia after an Amnesty report documenting the use of NoviSpy to target dissidents and journalists whose phones were taken while in government custody. Police never asked detainees for their passwords and instead broke into them using Cellebrite, Amnesty said, and from there implanted the spyware.

A key difference between NoviSpy and Pegasus is that the former requires authorities to physically access the phone to embed the spyware whereas the latter can infiltrate phones with no interaction from the victim and without the phone ever being seized. As a result, many of the NoviSpy infections found in Serbia have been discovered after victims were detained by authorities who took their phones during questioning.

John Scott-Railton, a Citizen Lab researcher involved in the Pegasus confirmation, said the spyware’s manufacturer, NSO Group, continues to enable authoritarian governments even as Apple threat notifications and sophisticated forensic research increasingly expose the attacks.

“Ten years ago, we found Pegasus spyware's first target, pro-democracy campaigner Ahmed Mansour and he's still jailed today,” Scott-Railton said. “Today, it's Serbian students campaigning for democracy.” 

“NSO has spent a decade promising reform, lobbying and shuffling ownership structures, and yet the product and the abuses haven't changed.”

The victims

Pegasus and NoviSpy spyware both have extraordinary snooping capabilities and can see photos, contacts, messages and files stored on phones. While NSO Group asserts that it has safeguards to prevent abuses, attacks on members of civil society continue to be discovered at a rapid clip.

A spokesperson for the NSO Group did not respond to a request for comment.

Ognjen Rašić, a student protester whose phone is still being studied by researchers, said he believes he was likely targeted with Pegasus since he has never been in police custody, which a NoviSpy attack would likely require.

A third-year college student, Rašić said he has been participating in peaceful protests against the government for years and began working as part of a student team dedicated to preparing for elections about a year ago.

The potential infection makes him deeply uncomfortable, he said, noting that spyware also allows operators to hear even conversations happening near, but not on, the phone because it can take over and turn on microphones.

“The spyware is a strong indicator that our government is very afraid of us,” he said. “They are ready to use whatever it takes to sabotage us because we're currently the strongest and the most influential political force in Serbia.”

The local elections in March were plagued by violence and irregularities, he said, adding that he and other protesters are determined to fight on, and are working to win in parliamentary elections expected to happen this fall.

“I want to send a clear message that I am not afraid and that my colleagues are not afraid,” he said. “We want justice, and I think the most important message is that students will win.” 

On Wednesday, opposition Serbian parliamentarian Radomir Lazović came forward to reveal his phone was one of the 14 targeted with spyware. Forensic research to determine if the attack was successful is still underway, according to the SHARE Foundation.

Lazović, a member of the Green-Left Front, called on the European Commission in March to take action against Serbian President Aleksandar Vučić for the rights abuses.

The attacks on him and the student protesters show “how [the government] are slipping into some sort of, I don't know, dictatorship,” he told Recorded Future News.

“They want to control the political opponents of the ruling party, which tells you what atmosphere we, as an opposition, are actually working in,” Lazović added. “If they are controlling us, if they're monitoring us, and they're tapping our phones and so on, it's really hard to have any kind of meaningful opposition working in Serbia.”