Skip to content
NewA calmer, faster ZeroHour
Threat actorhighExploited in the wild

Large group of Serbian opposition, activist figures targeted with spyware

The Record ()5 min read3 · 2 reads
Read at therecord.media
AI summary · glm-5.3-flashSummaries by Vani AI

Researchers found at least 14 Serbian opposition figures and student protesters targeted with Pegasus and NoviSpy spyware around elections; 11 more phones under investigation.

The SHARE Foundation, with Citizen Lab confirmation and Amnesty International peer review, found at least 14 Serbian opposition and civil society figures targeted with advanced spyware since December, including a member of Parliament, a local politician and student protesters. Citizen Lab confirmed zero-click Pegasus on a student protester's iPhone between December 2025 and January 2026, while Amnesty confirmed a new detection-evading NoviSpy Android variant in at least two cases. Targeting coincided with March 2026 local elections; Serbia's BIA intelligence agency denied the claims, and 11 additional alerted phones remain under forensic investigation.

Key facts
  • At least 14 Serbians targeted with spyware since December, including an MP and student protesters
  • NoviSpy requires physical access, typically installed after police seize phones during detention
  • One victim's text messages were read live on a pro-government TV network
  • Serbia's BIA intelligence agency dismissed the findings as sensationalism
  • Cellebrite cut ties with Serbia after its tools were used to install NoviSpy on detainees
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1203 Exploitation for Client ExecutionT1005 Data from Local SystemT1123 Audio CaptureT1113 Screen Capture
Tags
cellebritecitizen-labnovispynso-grouppegasusserbiashare-foundationspyware
Vendors
AppleNSO GroupCellebrite
Products
PegasusNoviSpy
Threat actors
NSO Group
Malware
PegasusNoviSpy
Organizations
SHARE FoundationCitizen LabAmnesty International
Countries
Serbia

From the original article

5 min read at therecord.media

At least 14 Serbians have been targeted with advanced spyware since December, with victims including a member of Parliament, a local opposition politician and student protesters, according to digital forensic researchers.

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.