At least 14 Serbian activists targeted in major spyware attack
What's the story
In a shocking revelation, the digital rights group Share Foundation has reported that at least 14 people from Serbia's civil society were targeted by advanced spyware earlier this year. The incident is being described as the largest documented wave of such an attack in the country. The discovery was made in August after Apple warned users across 110 countries about possible mercenary spyware infections on their devices.
Targeted group
Students were at the forefront of protests against Vucic
The Citizen Lab, a research organization that investigates spyware attacks, confirmed that at least one of the Serbians was targeted with NSO Group's Pegasus spyware.
This would have given the attacker complete access to their device.
Among those targeted were members of a Serbian student movement that has been critical of President Aleksandar Vucic since 2024.
The movement emerged from nationwide protests after a train station collapsed that winter and is one of Europe's largest student movements.
Government response
Ruling party denies allegations
While there is no evidence linking President Vucic's government to the Pegasus spyware attack, other spyware used against students, such as NoviSpy, has been previously associated with Serbian authorities.
However, Ana Brnabic, the parliamentary speaker and a ranking member of the ruling Serbian Progressive party denied these allegations in an interview with Euronews Serbia TV on Wednesday.
"Absolutely not," she said. "I do not believe a single word they've [students, Share] said."
Election implications
Spyware attack could be test run for upcoming elections
The timing of the spyware attacks, which coincided with March's local elections, has led some to speculate that it could have been a test run for the upcoming snap elections scheduled for this October.
"This is the largest documented wave of surveillance in Serbia so far," said Andrijana Ristic, a policy adviser at Share.
"We imagine... that the local elections were basically used as a test for the ruling party to see [the spyware's] strengths."
Reaction
Mercenary spyware targeting pro-democracy movement
John Scott-Railton, a senior researcher at the Citizen Lab, said their forensic findings and Apple's recent threat notifications indicate that Serbia's peaceful pro-democracy movement is being targeted with mercenary spyware ahead of key 2026 election cycles.
One of the targeted students, Milica Popovic, described the attacks as "cruel" but also emphasized that they wouldn't deter her or the student movement from their cause.
Company profile
NSO Group under fire for enabling authoritarian regimes
NSO Group, which began as an Israeli company, the maker of Pegasus spyware, has been under fire for enabling authoritarian regimes to target journalists, human rights activists, and dissidents.
The Israeli company is now under US ownership and is reportedly looking to enter the US market. However, incidents like these raise questions about its so-called rebranding as an "ethical spyware company."
A US court has permanently barred NSO Group from targeting WhatsApp users and Meta products.