Serbian opposition figures and student protesters hit with Pegasus and NoviSpy; 29 MEPs urge slowing Serbia's EU accession

The SHARE Foundation, with Citizen Lab confirmation and Amnesty International peer review, documented at least 14 Serbian opposition figures, civil society members and student protesters — including an MP — targeted with Pegasus and a new NoviSpy Android…

The SHARE Foundation, with confirmation from the Citizen Lab and peer review by Amnesty International, has documented what SHARE calls the largest spyware campaign in Serbia's history: at least 14 Serbian opposition figures, civil society members and student protesters targeted since December 2025 (Security Affairs dates the wave to early 2026), including an opposition member of Parliament, a local politician (described by Security Affairs as a local councilor) and student protesters, with 11 additional alerted phones still under forensic investigation. The targeting coincided with the March 2026 local elections. The Citizen Lab confirmed a zero-click Pegasus infection, delivered via an iMessage exploit with no victim interaction, on a student protester's iPhone between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1, and Pegasus attribution was not assigned. Pegasus grants full device access to messages, photos, microphone and camera. SHARE and Amnesty also identified a new, detection-evading NoviSpy Android variant in at least two cases, including on a student activist's Android phone seized by Serbian authorities during police questioning; NoviSpy requires physical access and is typically installed after police seize phones during detention, and the evidence points to Serbian government authorities. The Record reports that one victim's text messages were read live on a pro-government TV network, and that Cellebrite cut ties with Serbia after its tools were used to install NoviSpy on detainees. Targets were advised to enable Lockdown Mode and treat Apple Threat Notifications as presumed infections. Serbia's BIA intelligence agency dismissed the findings as sensationalism, and the Serbian government did not respond to CyberScoop's request for comment. On Friday (2026-09-04), 29 Members of the European Parliament sent a letter demanding Serbia's EU accession be slowed until a spyware investigation is completed, with demands including rule-of-law accountability conditions, and urging European Commission President Ursula von der Leyen to cancel a planned visit to Serbia, calling the surveillance 'a direct state attack on democracy' ahead of upcoming elections.

• At least 14 Serbian opposition figures, civil society members and student protesters — including an opposition MP and a local politician/councilor — were targeted since December 2025 (Security Affairs dates the campaign to early 2026); 11…
• Citizen Lab confirmed zero-click Pegasus (NSO Group), delivered via an iMessage exploit with no victim interaction, on a student protester's iPhone between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1; Pegasus…
• Pegasus grants full device access to messages, photos, microphone and camera (Security Affairs).
• Amnesty confirmed a new, detection-evading NoviSpy Android variant in at least two cases, including on a student activist's Android phone seized during police questioning; NoviSpy requires physical access, is typically installed after…
• The targeting coincided with the March 2026 local elections; SHARE calls it the largest documented surveillance wave in Serbia's history.
• One victim's text messages were read live on a pro-government TV network (The Record).
• Cellebrite cut ties with Serbia after its tools were used to install NoviSpy on detainees (The Record).
• Targets were advised to enable Lockdown Mode and treat Apple Threat Notifications as presumed infections (Security Affairs).