At least 14 people in Serbia, including student activists, opposition lawmakers and local officials, were targeted with advanced mercenary spyware in the months leading up to the country’s March local elections, according to reports. The disclosure came after Apple sent threat notifications to users across 110 countries on August 13 and represents the largest documented wave of such attacks in Serbia, raising concerns that similar digital surveillance could be used ahead of parliamentary elections scheduled for October.
The confirmed victims include members of the student protest movement that has shaken Serbia since late 2024, political activists, an opposition lawmaker and a local councilor. Forensic analysis by Amnesty International’s Security Lab, Citizen Lab and other technology researchers found that at least one device was infected with Pegasus, the zero click spyware developed by Israel’s NSO Group. At least two other devices reportedly contained malicious software similar to NoviSpy, a tool first identified in Serbia by Amnesty International in December 2024.
In one case, a student’s iPhone was reportedly compromised through a zero click iMessage exploit between December 2025 and January 2026, meaning the user did not need to interact with a message for the spyware to be installed. In another case, NoviSpy was found on the phone of a student whose device had previously been seized during police questioning. The findings have intensified concerns over the use of sophisticated surveillance technology against people involved in Serbia’s political opposition and student movement.
The timing of the infections has also attracted attention. The targeting coincided with local elections held on March 29 in 10 municipalities, contests that were widely viewed as a test of whether student backed opposition groups could organize effectively against the ruling Serbian Progressive Party. SHARE Foundation warned that the digital surveillance could be a preview of more aggressive monitoring ahead of the October national election.
Student leaders later shared their experiences at a press conference in Belgrade. Ella Zekovic, a political science student, said 14 students and operational team members from the movement had received warnings from Apple indicating that they may have been targeted by mercenary spyware. Another student, who identified herself only as Milica, described the intrusion as a serious violation of personal privacy, saying the alleged capabilities of the spyware created fear that private conversations and activities could be monitored.
Spyware Allegations Raise Election and Privacy Concerns
Serbian authorities have denied the allegations. Parliament Speaker Ana Brnabic, a senior member of the ruling Serbian Progressive Party, rejected the students’ claims in an interview. NSO Group, which markets Pegasus to government clients, did not immediately respond to requests for comment, while other reports state that they could not independently establish who was responsible for the infections.
The allegations have also raised questions about the legality of spyware use in Serbia. Legal experts say that deploying such surveillance tools without the required judicial authorization could constitute a criminal offense under Serbian law. Ana Toskic Cvetinovic of the oversight organization Partners Serbia said the Criminal Procedure Code allows secret surveillance only with a reasoned court decision, while no such decision has been made public in connection with the reported cases.
The broader controversy comes as Serbia faces an increasingly tense political environment. The student movement has become one of the most significant challenges to the government in recent years, while opposition groups are seeking to build on that momentum ahead of the parliamentary elections. The reported spyware attacks have therefore become part of a wider debate over democratic standards, digital privacy and the limits of state surveillance.
With the October vote approaching, the Serbia spyware allegations are likely to remain under scrutiny from civil society organizations, technology researchers and international observers. The confirmed infections demonstrate the sophistication of tools capable of targeting political activists and other individuals, while the unresolved question of who was behind the attacks adds another layer of concern as Serbia enters a politically sensitive election period.
