Digital Rights Group Reports Major Spyware Attack Ahead of Serbian Elections
Widespread Spyware Targeting in Serbia's Civil Society
By AJ Vicens
Sept 2 (Reuters) - At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday.
Discovery and Scale of the Attack
The wave of spyware infections, discovered in August after Apple notified people in 110 countries that they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement.
The incident offers a window into the use of powerful and invasive spyware aimed at students and political opposition members amid contentious elections, with national polls looming.
Targets and Methods Used
Victims Identified
Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, the group said. At least one device was targeted with Pegasus, made by Israeli company NSO Group, while at least two devices were targeted with malware similar to NoviSpy, which was first exposed by Amnesty International in Serbia in December 2024.
Attribution and Responses
Reuters could not determine who was responsible for the alleged infections. NSO has said it only sells to governments. Neither the Serbian government nor NSO Group immediately responded to requests for comment. In a report published in January, the NSO Group said it would work with clients to address potential violations.
“In cases of serious or repeated noncompliance, NSO may suspend or terminate the relationship,” the company said.
Details of the Spyware Attacks
Zero-Click Pegasus and NoviSpy Deployment
In one incident, a device associated with a member of the student movement was targeted with a zero-click version of Pegasus, meaning it did not require user interaction to deploy on the device. NoviSpy was found on the phone of a student movement member whose device had previously been taken away during police questioning, according to SHARE.
Timing and Political Context
The targeting coincided with the March 29 local elections held in 10 municipalities, according to SHARE, which said they were seen as a test of how student-backed political opposition groups could organize and compete against ruling party politicians. The digital targeting could be a preview of similar actions for parliamentary elections scheduled for October, the group said.
Expert Reactions and International Involvement
Statements from Amnesty International
"These new forensic findings show that Serbian student activists continue to be targeted with invasive spyware,” said Donncha Ó Cearbhaill, head of Amnesty International's security lab, which helped investigate the infections.
Citizen Lab's Findings
The Pegasus implant was put on at least one student's phone between December 2025 and January 2026, according to Bill Marczak, a senior researcher at the Citizen Lab, a Canadian internet watchdog group which is also investigating the infections. Apple's security updates have since neutralized the spyware, he added.
John Scott-Railton, another senior researcher with Citizen Lab, said his organization's findings and Apple's notifications "reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."
Broader Implications and Company Responses
NSO Group's Status and Ownership
NSO was blacklisted by the U.S. government in 2021 over concerns about rights abuses. In 2025, an American investment group acquired the company, although it is still operating out of Israel and under Israeli regulations.
Apple's Threat Notifications
In a statement, Apple said it sent threat notifications on August 13 to targeted users in 110 countries, adding that to date, it has notified users in more than 150 countries overall.
Reporting and Editing Credits
(Reporting by AJ Vicens in Detroit; Editing by Thomas Derpinghaus)
