At least 14 members of Serbian civil society, including student protesters, were targeted with advanced spyware earlier this year in what the digital rights group Share Foundation has called the largest documented wave of surveillance in the country to date. The attacks were uncovered after Apple warned users in 110 countries in August that they had likely been targeted by mercenary spyware, prompting forensic analysis by the Citizen Lab, which confirmed that at least one victim had been infected with NSO Group's Pegasus software, granting attackers total access to their device. The findings raise fresh concerns about state surveillance of Serbia's pro-democracy student movement ahead of snap elections in October, even as the government of Aleksandar Vučić denies involvement.

Those targeted included figures in the student movement that emerged from nationwide protests following a fatal train station collapse in late 2024, now one of Europe's largest such movements. While there is no direct evidence linking Vučić's government to the Pegasus attack, other spyware used against the students, called NoviSpy, has previously been tied to Serbian authorities. Share Foundation policy adviser Andrijana Ristic suggested the March local elections may have served as a "test" of the spyware and of pressure tactics ahead of October's vote. Parliamentary speaker Ana Brnabić flatly denied the allegations, while Citizen Lab researcher John Scott-Railton and targeted student Milica Popović both said the attacks show mercenary spyware, including NSO's Pegasus, remains a tool of political repression despite the firm's claims of reform.