At least 14 members of civil society in Serbia, including student activists and opposition figures, were targeted with advanced spyware ahead of local elections in March, according to the SHARE Foundation.
An investigation published Wednesday described the wave of infections as the largest documented case to date involving the use of such spyware against individuals in Serbia.
The case became public after Apple warned users in 110 countries in August that their devices may have been targeted by mercenary spyware.
According to SHARE, those targeted included members of the student movement, civil society activists, members of a parliamentary opposition party and a local councilor.
The investigation identified at least one device targeted with Pegasus, the spyware developed by the Israeli company NSO Group, while malware resembling NoviSpy was detected on at least two other devices.
NoviSpy had previously been exposed in Serbia by Amnesty International, which published findings in December 2024 concerning the use of surveillance technologies against activists.
Student Movement Also Targeted
One of the documented cases involved a member of the student movement whose phone was targeted with a “zero-click” version of Pegasus. Such technology can allow spyware to be installed without the user clicking on a link or interacting with a message.
In another case, NoviSpy was detected on the phone of a student whose device had previously been seized during police questioning, according to SHARE.
A student activist identified only as Milica said during a press conference in Belgrade that she received an Apple notification in August warning that her phone had been targeted.
“They may have access to the phone’s microphone and camera and activate them while we are showering or discussing private matters,” she said, describing the situation as a serious violation of privacy.
Targeting Ahead of Elections
According to the SHARE Foundation, the identified cases were linked in time to the March 29 local elections, which were held in 10 municipalities across Serbia.
The elections were seen as an important test of the ability of the student movement and opposition forces to organize politically and compete against the ruling party.
For this reason, SHARE warned that the use of spyware against activists and opposition figures could offer an indication of what may happen ahead of Serbia’s next parliamentary elections.
“The new forensic findings show that Serbian student activists continue to be targeted with invasive spyware,” said Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, which assisted with the investigation.
Citizen Lab researcher John Scott-Railton said the findings and Apple’s notifications showed that Serbia’s pro-democracy movement was being “aggressively targeted” with spyware ahead of important electoral cycles in 2026.
So far, it has not been established who was responsible for the infections.
Reuters reported that neither the Serbian government nor NSO Group immediately responded to requests for comment.
NSO Group has previously said that it sells its products only to governments and that it can suspend or terminate relationships with clients in cases involving serious or repeated violations of its rules.
Pegasus is among the world’s most powerful surveillance tools and can potentially give its operators extensive access to an infected device, including communications and other phone functions.
According to Citizen Lab researcher Bill Marczak, Pegasus was deployed on the phone of at least one student between December 2025 and January 2026. Subsequent Apple security updates neutralized that version of the spyware.
Questions Over Possible Legal Violations
The case has also raised serious questions about the legality of using such surveillance technologies.
Ana Toskic Cvetinovic of the organization Partneri Srbija said the use of spyware without judicial authorization could constitute a criminal offense under Serbian law.
She noted that Serbia’s Criminal Procedure Code defines the circumstances under which secret surveillance may be authorized and requires a reasoned judicial decision.
“To our knowledge, there is nothing like that here,” she said.
The revelations come at a time of heightened political confrontation in Serbia between the government of President Aleksandar Vučić and the student movement, as the country prepares for another electoral cycle.
For the organizations involved in investigating the case, the targeting of activists, students and opposition figures with sophisticated surveillance tools raises serious concerns about privacy, fundamental rights and the integrity of Serbia’s democratic process.
Apple said it sent threat notifications to targeted users in 110 countries on August 13, adding that it has now notified users in more than 150 countries about such threats.
