More than a dozen Serbians targeted with mercenary spyware, digital rights group says

At a news conference in Belgrade, a student activist who only identified herself as Milica said she received a notification her phone was infected in mid-August. "They could access the microphone and camera on the phone and turn them on while we shower or speak about private matters. It's not normal to do that; it's not normal that we don't have the right to privacy," she said. Reuters could not determine who was responsible for the alleged infections. NSO has said it only sells to governments. Neither the Serbian government nor NSO Group responded to requests for comment. In a report published in January, NSO Group said it would work with clients to address potential violations. In one incident, a device associated with a member of the student movement was targeted with a zero-click version of Pegasus, meaning it did not require user interaction to deploy on the device. NoviSpy was found on the phone of a student movement member whose device had previously been taken away during police questioning, according to SHARE. The targeting coincided with the March 29 local elections held in 10 municipalities, according to SHARE, which said they were seen as a test of how student-backed political opposition groups could organize and compete against ruling party politicians. "These new forensic findings show that Serbian student activists continue to be targeted with invasive spyware," said Donncha Ó Cearbhaill, head of Amnesty International's security lab, which helped investigate the infections. At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday. The wave of spyware infections, discovered in August after Apple notified people in 110 countries they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement. The incident offers a window into the use of powerful and invasive spyware aimed at students and political opposition members amid contentious elections, with national polls looming. Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, SHARE said. At least one device was targeted with Pegasus, made by Israeli company NSO Group, and at least two devices were targeted with malware similar to NoviSpy, first exposed by Amnesty International in Serbia in December 2024. In a post on the social media site X, U.S. Representative Joe Wilson, a South Carolina Republican, criticized the Serbian government, saying "totalitarian technology is being weaponized against a free people demanding the rule of law." In Belgrade, Ana Toskic Cvetinovic, a legal expert with the Partneri Srbija rights watchdog, said use of such software without judicial authorization constitutes a crime under Serbian laws. "There must be a reasoned court decision," said Toskic Cvetinovic. "To our knowledge, there is no such thing here." The Pegasus implant was put on at least one student's phone between December 2025 and January 2026, according to Bill Marczak, a senior researcher at the Citizen Lab, a Canadian internet watchdog group which is also investigating the infections. Apple's security updates have since neutralized the spyware, Marczak said. John Scott-Railton, another senior researcher with Citizen Lab, said his organization's findings and Apple's notifications "reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles." NSO was blacklisted by the U.S. government in 2021 over concerns about rights abuses. In 2025, an American investment group acquired the company, although it is still operating out of Israel and under Israeli regulations. In a statement, Apple said it sent threat notifications on August 13 to targeted users in 110 countries, adding that to date, it has notified users in more than 150 countries overall.

More than a dozen Serbians targeted with mercenary spyware, digital rights group says

Local elections and forensic findings

Spyware campaign targeted Serbian civil society

Reactions from U.S. lawmakers, researchers and Apple

Related News

Ultragenyx's rare disease drug fails in late-stage trial; shares plunge

Brief-Valero Benicia Plant Reports Odors Due to Clean Up, Fire Dept. Says

ADAR1 Capital Management reports Tenax Therapeutics common share purchase worth $1.38 million

Kontoor Brands outlines Helly Hansen 2030 plan targeting $1.1 billion-plus revenue

Elastic GVP, CAO Jane E. Bone sells 4,176 shares for $390,768.48