Serbian Activists, Lawmakers Hit in Spyware Wave, Digital Rights Group Says
At least 14 Serbian civil society members were targeted with spyware before March local elections, per the SHARE Foundation.
A digital rights group has documented what it calls the largest wave of spyware infections in Serbia's history, with at least 14 people from civil society targeted ahead of local elections in March.
The SHARE Foundation said the infections came to light in August after Apple alerted users in 110 countries that they may have been victims of mercenary spyware. Those targeted included student activists, opposition lawmakers, and a local councilor.
At least one device was infected with Pegasus, the spyware made by Israel's NSO Group. Two other devices showed malware similar to NoviSpy, a tool first exposed by Amnesty International in Serbia in December 2024.
A student activist who gave only her first name, Milica, told reporters in Belgrade that she was notified of the infection in mid-August. She said the spyware could have accessed her phone's microphone and camera, calling the intrusion a violation of privacy.
The SHARE Foundation said the targeting coincided with the March 29 local elections in ten municipalities, which were seen as a test for student-backed opposition groups. Amnesty International's security lab helped investigate the infections, and its head, Donncha Ó Cearbhaill, said the findings show activists continue to be targeted.
Researchers at the Citizen Lab, a Canadian internet watchdog, said the Pegasus implant on at least one student's phone was placed between December 2025 and January 2026. Apple's security updates have since neutralized the spyware, according to researcher Bill Marczak.
U.S. Representative Joe Wilson, a Republican from South Carolina, criticized the Serbian government on social media, saying "totalitarian technology" was being used against people demanding the rule of law.
Ana Toskic Cvetinovic, a legal expert with the Partneri Srbija rights group, said using such software without judicial authorization is a crime under Serbian law, and that no court order is known to exist.
Neither the Serbian government nor NSO Group responded to requests for comment. NSO has said it only sells to governments. The company was blacklisted by the U.S. government in 2021 over rights abuse concerns and was acquired by an American investment group in 2025, though it continues to operate from Israel.