More than a dozen students and opposition activists in Serbia have been targeted with spyware since the beginning of 2026 in what appears to be the largest documented wave of digital surveillance in the country to date. The revelations have raised concerns ahead of parliamentary elections scheduled for October, where growing dissent from the student protest movement is seen as a significant challenge to President Aleksandar Vučić’s ruling party.
Digital investigators based in Canada have verified at least one case involving Pegasus spyware, developed by the Israeli firm NSO Group. In this instance, a student activist’s phone was remotely infected without their knowledge. The infection method was identified as a “zero-click exploit” affecting Apple’s iMessage platform, allowing the spyware to be installed without any direct interaction from the target. Citizen Lab, a Toronto-based research organization that analyzed the case, noted that Apple’s latest security updates are believed to have patched this particular vulnerability.
In addition to Pegasus, at least one other case involved the installation of NoviSpy, a surveillance program reportedly developed within Serbia. This software was allegedly deployed on a target’s device while the individual was in police custody.
Serbian rights group Share Foundation, which has documented 14 such cases this year, stated that many of those affected were alerted to the compromise by Apple through security notifications sent to iPhone users in August. The targets include students, opposition figures, journalists, activists, and members of civil society, reflecting a broad campaign of digital intrusion.
Pegasus spyware is known for its ability to bypass encryption on messaging apps including Signal and WhatsApp by creating a mirror of the phone’s contents, which is relayed to NSO Group’s clients. The technology, sold for tens of millions of dollars, has previously been implicated in high-profile surveillance cases worldwide, targeting politicians, journalists, and activists. One notable victim is Hatice Cengiz, the widow of slain Saudi journalist Jamal Khashoggi.
John Scott-Railton of Citizen Lab described the recent surge in spyware attacks as a concerted effort to undermine Serbia’s pro-democracy movement in the run-up to a crucial election cycle. While investigations into other cases are ongoing, the scale and nature of these intrusions have drawn international attention to digital rights and political freedoms in Serbia.