BELGRADE – At least 14 people in Serbia were targeted with advanced spyware since the beginning of 2026 – the largest documented wave of such surveillance in the country to date, announced SHARE Foundation on 2 September.
“Those targeted include members of the student movement, activists, a member of parliament, and a local councilor, all from opposition parties. The timing coincides with the local elections held on 29 March 2026”, the statement from SHARE Foundation says.
According to the statement, this past August, twelve people contacted the SHARE digital forensics experts after receiving a warning on their phones that they had been targeted in a spyware attack. Apple issues these warnings with high confidence when a user has been targeted by mercenary spyware.
SHARE Foundation’s forensic analysis later confirmed two more infections – with a new version of NoviSpy, spyware first discovered in Serbia in 2024.
Two global digital forensics labs – Citizen Lab at the University of Toronto and Amnesty International’s Security Lab – independently confirmed SHARE Foundation’s findings. Citizen Lab investigators confirmed that the phone belonging to the student movement member who received the warning was infected with Pegasus, spyware developed by the Israeli company NSO Group.
The Student movement, which is, according to the opinion polls, the main challenger of the ruling Serbian Progressive Party in the anticipated parliamentary election, held a press conference on Wednesday, during which its members who were targeted with spyware addressed the public.
One of the students whose phone was confirmed to have been infected with Pegasus, Jelena Kontić, emphasized that she is very active in the field campaign of the movement, which means communicating with a large number of citizens and students, which is why, she believes, she was probably a target.
She assessed that not only her privacy and security were violated, but also the privacy and security of all the people with whom she communicated at the time – citizens, students and her family.
Three other students who also received a notification from Apple that their phone was potentially infected shared their feelings about the whole situation.
They pointed out that someone needs to be held accountable for it, with the assessment that “it is not normal that someone is recording them and that they do not have the right to privacy”, FoNet news agency reported.
Meanwhile, Speaker of the Serbian parliament Ana Brnabić, speaking for Euronews Television following the press conference, said that the state was not behind it.
“We haven’t heard any evidence that it was actually used,” said Brnabić, adding that it would be “idiotic” for someone who uses software worth several million euros to leave such traces behind.
Brnabić also added that the student press conference was directed towards “international audiences”.
First recorded cases of spyware use in Serbia date back to 2023
In November 2023, the first recorded cases of attempted spyware use against two civil society members were made public by the SHARE Foundation.
At the time, the Foundation stated it believed that these spyware attacks on representatives of the critical public have a detrimental effect on democracy and human rights and reminded that the use of spyware is illegal and in violation of democratic values.
Pegasus software, used both in 2023 and in 2026, is military-grade spyware, sold exclusively to states and state agencies. It can be installed remotely, with no interaction from the user required, and its key components – the control interface and the servers storing collected data – are typically based in the client country, at the agency’s own premises or headquarters. By contrast, installing the newly discovered spyware requires physical access to the device.
Regarding the latest targeting of students, an MP, and a local councilor, SHARE Foundation stated that political espionage “strikes directly at the equality of political actors and the integrity of the electoral process”.
“Democracy depends on elected representatives being free to communicate, organize, and hold those in power to account – without fear of secret, unlawful surveillance. If even they aren’t protected from such attacks, citizens can hardly expect their own privacy and political freedoms to be respected. Practices like this erode trust in institutions, and in the very possibility of free political action”, the statement reads.
