Based on comprehensive forensic evaluations and civil society documentation, Serbian authorities have engaged in extensive and covert digital surveillance campaigns, targeting journalists, environmental activists, political opponents, and civil society members.
On 19 October, the Citizen Lab, in collaboration with SHARE Foundation, confirmed two new high-profile cases of advanced spyware targeting in this country. The victims include University of Belgrade Rector Vladan Đokić and Senior Prosecutorial Associate Rade Bajić of the Public Prosecutor’s Office for Organized Crime.
It was clarified that Professor Đokić’s mobile device had been compromised earlier this year by NSO Group’s Pegasus spyware via a zero-click exploit.
Đokić has earned recognition for championing student-led demonstrations and defending university autonomy. He was expected to be the candidate on the Student List for the parliamentary election, but was ultimately not nominated by the students for reasons that were not disclosed.
Meanwhile, Rade Bajić, a senior prosecutorial associate who investigated the “General Staff case” implicating high-ranking state officials, received an official Apple security notification in August warning that his device had been targeted with mercenary spyware with a high degree of confidence.
In addition, in September 2026, SHARE Foundation reported that at least 14 individuals in Serbia, including students, activists, a member of parliament, and a local opposition councilor, had been targeted by advanced spyware earlier in the year.
According to interlocutors of EWB, these cases represented a severe escalation in state-sponsored digital repression and the suppression of civil liberties in Serbia.
“New cases of spyware use in Serbia indicate the expansion of the scope of surveillance and the circle of targets – from civil society representatives, journalists and activists, through members of the Student Movement and opposition politicians, to university rectors and employees of the Prosecutor’s Office. The lack of accountability and failure of judicial institutions deepen the atmosphere of impunity, in which any critical voice can become the target of illegal digital surveillance“, states Andrijana Ristić, representative of SHARE Foundation.
Similarly, Anđela Savić, researcher at the Belgrade Centre for Security Policy, stresses that “the most recent findings suggest that we are not talking about isolated incidents, but about digital repression in Serbia and the pattern of surveillance”.
“Among other things, Citizen Lab and SHARE Foundation forensic confirmed that Rector Vladan Đokić’s phone was infected with Pegasus, a sophisticated spyware that is sold exclusively to state actors, at a very high price”, Savić remarks.
She adds that, since spyware is extremely intrusive, they also allow the attacker access to anyone with whom the victim is in contact.
“Therefore, these attacks are a slap in the face and it is additionally disturbing that they take place during the election campaign, thus affecting the integrity of the election process”, Savić says.
So far, 23 cases of spyware targeting in Serbia have been publicly published
While intelligence agencies such as the Security Information Agency (BIA) and the Ministry of Interior of Serbia have legal avenues to request wiretaps, reports have highlighted the use of commercial mercenary spyware against domestic targets without transparent legal justification.
According to the reports by independent organisations, state security actors have increasingly relied on sophisticated mobile intrusion software, notably Pegasus.
These tools can stealthily infiltrate smartphones, extract encrypted messages, track real-time GPS locations, and covertly activate device microphones and cameras without the user’s knowledge or consent.
“So far, 23 cases of spyware targeting in Serbia have been publicly published, but there are numerous other cases that are not yet public, and in some cases, analyses are still ongoing. The first criminal complaint was filed in 2024 and covered four cases of abuse of the Cellebrite tool and the use of the NoviSpy spyware. It was supplemented by three more cases in 2025, while in 2026 a new criminal complaint was filed, this time for Pegasus spyware infection. None of the cases from the past two years have advanced significantly beyond the initial stage, even though they are serious crimes prosecuted ex officio”, Andrijana Ristić clarifies.
Elaborating on the same topic, Anđela Savić notes that “as early as in 2023 the attempted attacks by Pegasus spyware was reported”.
“In 2024, Amnesty International found that the cell phones of journalist Saša Milanov and some activists were unlocked with Cellebrite forensic tool and infected Serbian-made NoviSpy, while they were detained and questioned by the security services. In 2025, female journalists of BIRN were the targets of the attempted infection by Pegasus, and the spyware was also used for the illicit surveillance of some farmers. In addition, director of the Belgrade Centre for Security Policy was the target of the Pegasus infection, and the organization has been the victim of long – term and covert cyberattacks by hacker groups associated with Russian intelligence services”, she remarks.
Savić adds that among the documented methods of illegal surveillance are Pegasus and NoviSpy spyware, as well as “misuse of forensic tools, fishing, unauthorized access to accounts and interception of communications”.
“At the same time, there is a mass surveillance with the help of biometric cameras. Therefore, we should bear in mind that digital and physical security are not separate, i.e. that the information obtained by digital surveillance can be used for tracking, intimidation, discreditation, threatening and arrests. Digital attacks have very real consequences in the physical world”, Savić warns.
“Normalization of repression”
Serbian officials have repeatedly dismissed allegations of cyberespionage and illegal surveillance as false, asserting that there is “no evidence” connecting the state to these digital attacks.
In addition, key oversight bodies and security agencies have routinely failed to respond to formal right-of-reply inquiries or requests for information submitted by international human rights organizations like Amnesty International.
Although criminal complaints have been filed by victims and non-governmental organizations with specialized judicial bodies, such as the Special Prosecutor’s Office for High-Tech Crime, investigations have moved at a sluggish pace.
“We expect the fact that among the targets of spyware are employees of the Prosecutor’s Office for Organized Crime to further indicate the urgency and seriousness of these cases and encourage the prosecutor’s office for high-tech crime to conduct a thorough, independent and effective investigation. The use of spyware is a serious violation of human rights, in particular the right to privacy and the protection of personal data”, Andrijana Ristić underlines.
She adds that, when a target is employed in a prosecutor’s office, the consequences can be even more serious: the integrity of criminal proceedings, the confidentiality of sensitive data and the independence of the judiciary are potentially compromised.
Anđela Savić agrees that “the court epilogue is necessary, but the current procedure of the institutions does not give much reason for optimism”.
“The Belgrade Centre for Security Policy was among the ten organizations that, as early as December 2024, filed a criminal complaint for the illegal access to the cell phones of journalists and activists and for the installation of NoviSpy spyware. According to data obtained in May 2026, this case is still in the pre-investigation phase, and only two out of seven affected individuals have been heard. In early October 2026, the SHARE Foundation filed a new criminal complaint based on a confirmed Pegasus infection on a female student’s cell phone”, Savić says.
According to her, “without an independent, thorough investigation and the determination of responsibilities for those who ordered, conducted, and used the data collected through these means, we cannot speak of the rule of law. If the government remains silent, it sends the message that illegal surveillance is an acceptable method for dealing with dissenters”.
“The consequences are normalization of repression, further intimidation of citizens, the so-called chilling effect, self-censorship and less and less room for free action”, Anđela Savić concludes.
