Serbians targeted with spyware in country’s ‘largest documented wave of surveillance’

At least 14 people from across Serbian civil society were targeted with advanced spyware earlier this year, marking what the digital rights group Share Foundation described as the largest documented wave of such infections in Serbia to date. This wave of spyware infections was discovered in August after Apple notified individuals in 110 countries that they had likely been victims of mercenary spyware.

The Citizen Lab, which conducts forensic analyses of spyware attacks, released an analysis on Wednesday revealing that at least one of the targeted Serbians had been infected with the NSO Group’s Pegasus spyware, granting the attacker total access to the device. Those targeted included members of a Serbian student movement that has been a significant challenge to the government of Aleksandar Vučić since 2024. This movement emerged from nationwide protests following the collapse of a train station that winter and is recognized as one of the largest student movements in Europe.

Vučić, who has been in power for over a decade, has faced criticism for undermining institutions while steering the country closer to Moscow. While there is no evidence linking Vučić’s government to the targeting of students with Pegasus spyware, other spyware used against the students, such as NoviSpy, has previously been associated with Serbian authorities.