Serbians targeted with spyware in country’s ‘largest documented wave of surveillance’
At least 14 members of Serbian civil society, including student protesters, were targeted with advanced spyware earlier this year in what the digital rights group Share Foundation has called the largest documented wave of surveillance in the country to date. The attacks were uncovered after Apple warned users in 110 countries in August that they had likely been targeted by mercenary spyware, prompting forensic analysis by the Citizen Lab, which confirmed that at least one victim had been infected with NSO Group's Pegasus software, granting attackers total access to their device. The findings raise fresh concerns about state surveillance of Serbia's pro-democracy student movement ahead of snap elections in October, even as the government of Aleksandar Vučić denies involvement.
Those targeted included figures in the student movement that emerged from nationwide protests following a fatal train station collapse in late 2024, now one of Europe's largest such movements. While there is no direct evidence linking Vučić's government to the Pegasus attack, other spyware used against the students, called NoviSpy, has previously been tied to Serbian authorities. Share Foundation policy adviser Andrijana Ristic suggested the March local elections may have served as a "test" of the spyware and of pressure tactics ahead of October's vote. Parliamentary speaker Ana Brnabić flatly denied the allegations, while Citizen Lab researcher John Scott-Railton and targeted student Milica Popović both said the attacks show mercenary spyware, including NSO's Pegasus, remains a tool of political repression despite the firm's claims of reform.
In short
- 14+ Serbian civil society figures, including students, hit by spyware
- Citizen Lab confirmed NSO Group's Pegasus used in at least one case
- Serbian government denies involvement ahead of October elections
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The targeting of civil society figures with powerful spyware, especially amid a large protest movement and approaching elections, warrants serious scrutiny: such tools can expose sources, communications and organising, and their use may chill lawful dissent. Even without proof identifying the operator, the reported infections and Serbia’s documented use of other spyware against students support calls for an independent investigation and stronger safeguards.
The case against
The available findings establish that people were targeted and that at least one device had Pegasus, but they do not establish who ordered or carried out the attack, so attributing it to the Serbian government would go beyond the evidence. Governments may argue that narrowly authorised surveillance can serve legitimate security purposes; any assessment should distinguish that possibility from the allegations and require evidence, legal oversight and accountability before drawing conclusions.
Explained simply
Spyware is software that can be used to secretly monitor a phone, including its messages, calls and files. Pegasus is made by the Israeli company NSO Group and is sold to governments; Serbia has also been linked to the use of a separate programme called NoviSpy.
The people reported to have been targeted include members of civil society and students involved in a protest movement. The movement grew after a fatal railway station collapse in late 2024 and has become a prominent challenge to President Aleksandar Vučić’s government.
The allegations matter because they concern the privacy and safety of people organising protests, as well as the use of surveillance around elections. Serbian officials deny government involvement in the Pegasus attacks, and investigators have not established a direct link to the government.
Cybersecurity Government Politics Technology