Victim

Serbian student activists

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 2, 2026 · last 11d ago

Timeline2 articles

European parliament members call for slowdown of Serbia’s EU entry over spyware use

29 MEPs urge delaying Serbia's EU accession after researchers found Pegasus and NoviSpy spyware on student activists' phones.

Twenty-nine Members of the European Parliament sent a letter Friday demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed. The letter follows a SHARE Foundation report, with Amnesty International and the Citizen Lab, documenting Pegasus and NoviSpy infections on Serbian student activists' phones; NoviSpy evidence pointed to Serbian government authorities, though Pegasus attribution was not assigned. The MEPs also urged European Commission President Ursula von der Leyen to cancel a planned visit to Serbia and called the surveillance 'a direct state attack on democracy' ahead of upcoming elections. The Serbian government did not respond to requests for comment.

CyberScoopSep 4, 21:02 UTC · 11d agoPolicy & legal in the wild

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

Researchers confirmed the first 2026 Pegasus infection and a new NoviSpy variant on 14 Serbian activists, likely surveillance by Serbian authorities ahead of elections.

Citizen Lab confirmed with high probability the first forensically confirmed Pegasus infection of 2026, on a Serbian student activist hacked via a zero-click exploit between December of last year and January. Amnesty International confirmed two devices infected with a new NoviSpy variant, and the SHARE Foundation documented 14 targets including a member of parliament and a local government official, the largest documented spyware wave in Serbia to date. Evidence points to Serbian police or intelligence services, with NoviSpy infections occurring around police detention ahead of key local and parliamentary elections. Apple threat notifications preceded the findings, and updated iOS versions break the exploit chain.

CyberScoopSep 2, 15:03 UTC · 13d agoThreat actor in the wild

Appears with

organization University of Toronto 2 malware Pegasus 2 product NoviSpy 2 product Pegasus 2 organization Amnesty International 2 organization Citizen Lab 2 malware NoviSpy 2 organization SHARE Foundation 2 vendor NSO Group (Pegasus) 1 threat actor Serbian police or secret service 1 organization European Parliament 1 product iOS 1 vendor Apple 1 vendor NSO Group 1 threat actor Serbian authorities (NoviSpy) 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.