At least 14 people in Serbia, including members of the student movement, activists and opposition representatives, have been targeted with advanced spyware since the beginning of 2026, representing the largest documented wave of such surveillance in the country. SHARE Foundation’s forensic analysis, independently confirmed by Citizen Lab and Amnesty International’s Security Lab, established that the iPhone of a student activist was infected with NSO Group’s Pegasus through a zero-click iMessage exploit, while a new version of NoviSpy was detected on Android phones, including one belonging to a student whose device had previously been confiscated during police detention. The targeting coincided with the March 2026 local elections and follows earlier findings linking NoviSpy infrastructure to Serbia’s Security Intelligence Agency, raising serious concerns about privacy, freedom of expression and association, political participation and electoral integrity. Twenty-nine Members of the European Parliament have called on the European Commission to take concrete action, including suspending IPA III and Growth Plan payments to Serbia pending an independent investigation, while the Commission has stated that unlawful surveillance of citizens and political opponents would be unacceptable if confirmed. Serbian authorities have denied state involvement. Read more here.
Source: SHARE Foundation / Civic Initiatives