Serbia's largest spyware wave targets student protesters ahead of elections

In August, Apple sent notifications to people across 110 countries with a stark message: their devices had likely been compromised by mercenary spyware. Among those who received the alert were at least 14 members of Serbian civil society, marking what digital rights researchers say is the largest documented wave of such attacks the country has ever seen.

The targeting was not random. Share Foundation, a Belgrade-based digital rights organization, identified student protesters as prominent among the victims—young activists who have emerged as one of Europe's most significant student movements since 2024. Their movement coalesced around countrywide protests following the collapse of a train station that winter, and they have become a persistent challenge to the government of Aleksandar Vučić, who has held power for more than a decade. During that time, critics argue, he has systematically weakened institutions while drawing Serbia closer to Moscow.

Forensic analysis by the Citizen Lab revealed that at least one of the Serbian targets had been hit with Pegasus, spyware made by the NSO Group. The tool grants attackers what researchers describe as total access to a device—its files, messages, location, camera, microphone. While there is no direct evidence linking Vučić's government to the Pegasus attack specifically, other spyware used against the students, including a tool called NoviSpy, has been previously connected to Serbian authorities. When asked about the attacks, Ana Brnabić, the parliamentary speaker and a senior member of the ruling Serbian Progressive Party, flatly denied them. "Absolutely not," she said in an interview with Euronews Serbia TV on Wednesday. "I do not believe a single word they've said."

The timing of the attacks carries particular weight. The spyware wave occurred during March's local elections, and Share Foundation researchers believe it may have served as a test run ahead of snap elections scheduled for October 2026. Andrijana Ristic, a policy adviser at Share, suggested the ruling party used the local vote as an opportunity to assess the spyware's capabilities and gauge how much pressure it could exert over student activists and opposition figures. John Scott-Railton, a senior researcher at the Citizen Lab, framed the discovery more starkly: "Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."

For those targeted, the violation was deeply personal. Milica Popović, one of the student activists whose device was compromised, described the experience as cruel. The knowledge that someone had accessed her private space without permission left her feeling exposed. Yet she was clear that the attack would not achieve its apparent goal. "If their intention was to frighten us, or make us stop, it will not work," she said.

The Pegasus spyware at the center of the Serbian case carries a long history of abuse. The NSO Group, which developed it, began as an Israeli company with close military ties and is now under US ownership. Pegasus has been documented targeting journalists, human rights campaigners, and political dissidents in authoritarian states worldwide. The company has spent the past decade promising reform and attempting to rebrand itself as an ethical operator, even as it seeks entry into the US market and tries to get itself removed from the Commerce Department's blacklist. A US court has permanently barred NSO from targeting WhatsApp users and Meta products, though it remains unclear whether the Serbian attacks used those platforms. The fresh wave of Pegasus deployments against democracy campaigners in Serbia undercuts any claim to reform. As Scott-Railton put it: "NSO spent a decade promising reform, yet their spyware is still an instrument of political repression."