At least 14 people from across Serbian civil society were targeted with advanced spyware earlier this year in what the digital rights group Share Foundation said was the largest documented âwave of such infection in Serbia to date.
The wave of spyware infections was discovered in August after Apple notified people in 110 â countries that they had probably been victims â of mercenary spyware.
The Citizen Lab, which carries out forensic analyses of spyware attacks, released an analysis on Wednesday showing that at least one of the Serbians had been targeted with the NSO Groupâs Pegasus spyware, which would have given the attacker âtotal access to the deviceâ.
Share said those targeted included members of a Serbian student movement that has been a thorn in the side of the government of Aleksandar VuÄiÄ since 2024. Coalescing out of countrywide protests that followed the collapse of a train station that winter, it is one of the largest student movements in Europe.
VuÄiÄ has been in power for more than a decade, during which time critics have said he has overseen a hollowing-out of institutions while steering the country closer to Moscow.
There is no evidence that VuÄiÄâs government was the entity that targeted the student with the Pegasus spyware. However, other spyware used against the students, including a software called NoviSpy, has been previously connected to Serbian authorities.
In an interview with Euronews Serbia TV on Wednesday, Ana BrnabiÄ, the parliamentary speaker and a ranking member of the ruling Serbian Progressive party, denied that students had been spied on. âAbsolutely not,â she said. âI do not believe a single word theyâve [students, Share] said.â
Share said the timing â during Marchâs local elections â may have been a practice run before snap elections set for this October.
âThis is the largest documented wave of surveillance in Serbia so far,â said Andrijana Ristic, a policy adviser at Share. âWe imagine ⦠that the local elections were basically used as a test for the ruling party to see [the spywareâs] strengths, but also to see the amount of pressure they are able to exert over the students and the opposition.â
John Scott-Railton, a senior researcher at the Citizen Lab, said: âOur forensic findings, and this fresh wave of Apple threat notifications reveal that Serbiaâs peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles.â
Milica PopoviÄ, one of the students who was targeted, called the attacks âcruelâ. She said: âThinking that someone may have entered my private space without my knowledge made me feel so exposed.â
But, she said, the attack, as uncomfortable as it was, would not deter her or the student movement. âIf their intention was to frighten us, or make us stop, it will not work.â
after newsletter promotion
NSO Group, which makes Pegasus, a spyware that has been leveraged by authoritarian states to target journalists, human rights campaigners and dissidents, began as an Israeli company with close ties to the military.
It is now under US ownership, and appears to be searching for a way into the US market, including through efforts to get off the US Commerce Departmentâs blacklist. However, this and other incidents will raise questions about what has been described as their attempt to rebrand as an âethical spyware companyâ.
NSO Group has been permanently barred by a US court from targeting WhatsApp users and Meta products. It is unclear if this most recent Pegasus attack happened via WhatsApp.
âToday, Pegasus is still being used to hack people campaigning for democracy. NSO spent a decade promising reform, yet their spyware is still an instrument of political repression,â said Railton.
NSO Group was approached for comment.
Leave a Reply