Key facts
- At least 14 Serbian civil society members were targeted with advanced spyware.
- The spyware infections were discovered in August after Apple notified users.
- The Citizen Lab confirmed at least one target was hit with NSO Group's Pegasus spyware.
- The targeted individuals included members of a student movement critical of the government.
- Share Foundation described this as the largest documented wave of surveillance in Serbia.
At least 14 individuals across Serbian civil society were targeted with advanced spyware earlier this year, marking the largest documented wave of such infections in Serbia to date, according to the digital rights group Share Foundation.
The wave of spyware infections was discovered in August after Apple notified people in 110 countries that they had likely been victims of mercenary spyware. The Citizen Lab, which analyzes spyware attacks, released findings showing at least one Serbian victim was targeted with NSO Group’s Pegasus spyware, which provides complete access to a device.
Share Foundation stated that those targeted included members of a Serbian student movement that has been critical of President Aleksandar Vučić's government. This movement emerged from countrywide protests following a train station collapse. Vučić has been in power for over a decade, with critics alleging a weakening of institutions and closer ties to Moscow under his leadership.
There is no direct evidence linking Vučić's government to the spyware attacks. Ana Brnabić, the parliamentary speaker and a senior member of the ruling Serbian Progressive party, denied the spying allegations, stating, "Absolutely not. I do not believe a single word they’ve [students, Share] said."
Share Foundation suggested the timing, coinciding with March's local elections, may have served as a test run before snap elections scheduled for October. "This is the largest documented wave of surveillance in Serbia so far," said Andrijana Ristic, a policy adviser at Share. "We imagine … that the local elections were basically used as a test for the ruling party to see [the spyware’s] strengths, but also to see the amount of pressure they are able to exert over the students and the opposition."
John Scott-Railton, a senior researcher at The Citizen Lab, commented, "Our forensic findings, and this fresh wave of Apple threat notifications reveal that Serbia’s peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles." Milica Popović, one of the targeted students, described the attacks as "cruel" and making her feel "exposed," but affirmed that the incident would not deter her or the movement, stating, "If their intention was to frighten us, or make us stop, it will not work."
NSO Group, the maker of Pegasus spyware, which has been used by authoritarian states against journalists, activists, and dissidents, is an Israeli company now under U.S. ownership. It is reportedly seeking entry into the U.S. market and aiming to be removed from the U.S. Commerce Department’s blacklist. Railton noted, "Today, Pegasus is still being used to hack people campaigning for democracy. NSO spent a decade promising reform, yet their spyware is still an instrument of political repression."