Serbian Opposition Figures Hit by Pegasus and NoviSpy Spyware

At least 14 Serbian civil society figures—including a member of parliament, a local opposition politician, and student protesters—have been targeted with advanced mobile spyware since December 2025, according to a joint investigation by the SHARE Foundation, Citizen Lab, and Amnesty International's Security Lab. The campaign came to light in August when 12 individuals contacted the SHARE Foundation after receiving Apple threat notifications warning of likely targeted mercenary spyware activity on their devices.

Researchers confirmed two distinct spyware families in use. Citizen Lab verified that one student protester's iPhone was infected with zero-click Pegasus spyware between December 2025 and January 2026, exploiting previously unknown vulnerabilities to compromise the device without any user interaction. Amnesty International's Security Lab separately confirmed infections by a newly updated variant of NoviSpy, an Android spyware strain previously linked to Serbian state-aligned actors, used in at least two cases. Forensic analysis is ongoing on 11 additional phones, while the SHARE Foundation noted that one NoviSpy victim's private text messages were broadcast live on a Serbian television network aligned with the ruling party. Users concerned about exposure can run a quick privacy checkup to review their device's current security posture.

The targeting timeline closely aligns with Serbia's March local elections, in which student protesters played a prominent organizing role against the increasingly authoritarian ruling party. Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, warned that the NoviSpy variant "appears to have been updated to avoid detection," and described the surveillance as "another element of a broader pattern of systemic repression of critical voices," with attacks historically spiking around heightened political moments ahead of anticipated early parliamentary elections in October. Serbia's intelligence agency, the BIA, rejected the findings as "trivial sensationalism," accusing the investigating organizations of acting in the interests of foreign intelligence services.

The report builds on a documented history of digital repression in Serbia. In March 2025, Amnesty International confirmed that two Serbian investigative journalists had been targeted with Pegasus, and previous Citizen Lab and Access Now reports have repeatedly linked both Pegasus and NoviSpy to operations against journalists, dissidents, and civil society actors in the country. The growing sophistication of these commercial and state-aligned spyware tools, particularly the use of zero-click iOS exploits and stealthier Android payloads, underscores the urgent need for at-risk individuals to harden device hygiene and leverage tools like an email breach checker to identify whether associated accounts may have been compromised in parallel surveillance operations.