In one incident, a device associated with a member of the student movement was targeted with a zero-click version of Pegasus, meaning it did not require user interaction to deploy on the device. NoviSpy was found on the phone of a student movement member whose device had previously been taken away during police questioning, according to SHARE.
The targeting coincided with the March 29 local elections held in 10 municipalities, according to SHARE, which said they were seen as a test of how student-backed political opposition groups could organize and compete against ruling party politicians. The digital targeting could be a preview of similar actions for parliamentary elections scheduled for October, the group said.
"These new forensic findings show that Serbian student activists continue to be targeted with invasive spyware," said Donncha Ó Cearbhaill, head of Amnesty International's security lab, which helped investigate the infections.
In Belgrade, Ana Toskic Cvetinovic, with the Partneri Srbija rights watchdog and a legal expert, said that use of such software without authorisation from the court constitutes a crime under Serbian laws.
"The Criminal Procedure Code envisions the situations in which secret surveillance is allowed ... there must be a reasoned court decision. To our knowledge, there is no such thing here," said Toskic Cvetinovic.
"Our constitution guarantees the right to the protection of personal data," she said.
The Pegasus implant was put on at least one student's phone between December 2025 and January 2026, according to Bill Marczak, a senior researcher at the Citizen Lab, a Canadian internet watchdog group which is also investigating the infections. Apple's security updates have since neutralized the spyware, he added.
John Scott-Railton, another senior researcher with Citizen Lab, said his organization's findings and Apple's notifications "reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."
NSO was blacklisted by the U.S. government in 2021 over concerns about rights abuses. In 2025, an American investment group acquired the company, although it is still operating out of Israel and under Israeli regulations.
In a statement, Apple said it sent threat notifications on August 13 to targeted users in 110 countries, adding that to date, it has notified users in more than 150 countries overall.
Students and activists describe the surveillance
At a news conference in Belgrade, a student activist who only identified herself as Milica said she received a notification her phone was infected in mid-August.
"They could access the microphone and camera on the phone and turn them on while we shower or speak about private matters. It's not normal to do that; it's not normal that we don't have the right to privacy," she said.
Reuters could not determine who was responsible for the alleged infections. NSO has said it only sells to governments. Neither the Serbian government nor NSO Group immediately responded to requests for comment. In a report published in January, the NSO Group said it would work with clients to address potential violations.
"In cases of serious or repeated noncompliance, NSO may suspend or terminate the relationship," the company said.
SHARE Foundation says at least 14 people were targeted
At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday.
The wave of spyware infections, discovered in August after Apple notified people in 110 countries that they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement.
The incident offers a window into the use of powerful and invasive spyware aimed at students and political opposition members amid contentious elections, with national polls looming.
Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, the group said. At least one device was targeted with Pegasus, made by Israeli company NSO Group, while at least two devices were targeted with malware similar to NoviSpy, which was first exposed by Amnesty International in Serbia in December 2024.
AAPL•
