At Least 14 in Serbia Targeted With Advanced Spyware, Rights Group Says

The infections were discovered in August after Apple notified people in 110 countries that they had probably been victims of mercenary spyware. The Citizen Lab, which carries out forensic analyses of spyware attacks, released an analysis on Wednesday showing that at least one of the Serbians had been targeted with NSO Group's Pegasus spyware, which would have given the attacker "total access to the device."

Share Foundation said those targeted included members of a Serbian student movement that has challenged the government of Aleksandar Vučić since 2024. The movement coalesced out of countrywide protests that followed the collapse of a railway station that winter, and is one of the largest student movements in Europe.

Vučić has been in power for more than a decade, and critics say he has overseen a hollowing-out of institutions while steering the country closer to Moscow. There is no evidence that his government was responsible for the spyware attacks. In an interview with Euronews Serbia TV on Wednesday, parliamentary speaker Ana Brnabić, a senior member of the ruling party, denied that students had been spied on. "Absolutely not," she said. "I do not believe a single word they've said."

Share Foundation said the timing of the infections, during March's local elections, may have been a practice run before snap elections set for October. "This is the largest documented wave of surveillance in Serbia so far," said Andrijana Ristic, a policy adviser at Share. "We imagine that the local elections were basically used as a test for the ruling party to see the spyware's strengths, but also to see the amount of pressure they are able to exert over the students and the opposition."

John Scott-Railton, a senior researcher at Citizen Lab, said the forensic findings and the fresh wave of Apple notifications reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles. Milica Popović, one of the students targeted, called the attacks "cruel." "Thinking that someone may have entered my private space without my knowledge made me feel so exposed," she said. But the attack, as uncomfortable as it was, would not deter her or the student movement. "If their intention was to frighten us, or make us stop, it will not work."

NSO Group, which makes Pegasus, began as an Israeli company with close military ties and is now under US ownership. Its spyware has been used by authoritarian states to target journalists, human rights campaigners and dissidents. The company has tried to rebrand as an ethical spyware maker and to get off the US Commerce Department's blacklist. NSO Group has been permanently barred by a US court from targeting WhatsApp users and Meta products. It is unclear if the latest Pegasus attack happened via WhatsApp. NSO Group was approached for comment.