Serbia sees largest documented spyware wave targeting activists, opposition

At least 14 people from Serbian civil society, including student activists, a member of Parliament, and a local opposition politician, were targeted with advanced spyware in what digital rights groups have described as the largest documented wave of such surveillance in the country. The targeting, which occurred between December 2025 and early 2026, was revealed after Apple notified potential victims in August that their devices had likely been compromised by mercenary spyware. Forensic investigations by the Citizen Lab and Amnesty International confirmed the use of two distinct spyware tools. One student activist's device was infected with the NSO Group's Pegasus spyware via a zero-click exploit, meaning no interaction was required from the victim. Amnesty International verified that two other devices were compromised with a new variant of Android spyware known as NoviSpy. The SHARE Foundation, a Serbian digital rights organization, coordinated the investigation after 12 individuals contacted them with Apple alerts. The timing of the infections coincided with local elections held in March 2026, which were marked by violence and irregularities.