Pegasus and NoviSpy Spyware Used Against Serbian Protesters
A widespread surveillance campaign targeting student protesters ahead of elections has been uncovered.
1Zero-Click Spyware Infection
An iPhone belonging to a member of Serbia's student protest movement was infected with Pegasus spyware without clicking any link or opening a file. Citizen Lab, in collaboration with SHARE Foundation, confirmed the use of an iMessage zero-click exploit. Such attacks are considered particularly dangerous as they require no action from the victim.
2Full Device Access
Pegasus spyware grants attackers complete access to the device, including messages, photos, notes, microphone, and camera. Apple patched this specific exploit in iOS 18.4.1, but unupdated devices remain vulnerable. The spyware can remain hidden for extended periods without the victim's knowledge.
3Large-Scale Surveillance Campaign
SHARE Foundation has documented at least 14 individuals targeted with advanced spyware since early 2026, including student movement members, civil society activists, an opposition MP, and a local councilor. This is described as the largest documented surveillance wave in Serbia's history.
4Election Timeline Connection
The surveillance wave coincides with local elections on March 29, 2026, and planned early parliamentary elections in October, following months of student-led anti-government protests. The timing suggests a deliberate strategy to monitor opposition voices during critical political periods.
5New Version of NoviSpy Detected
Amnesty Tech and SHARE Foundation found a new version of NoviSpy, a locally developed spyware, on an Android phone seized from a student activist during police questioning. Previous documentation showed Serbian authorities using Pegasus and Cellebrite tools against civil society.
6State Surveillance Suspicions
Donncha Ó Cearbhaill of Amnesty International's Security Lab directly linked state custody to spyware installation. SHARE's forensic evidence proves Serbian students were targeted with invasive Android spyware tools while detained by authorities.
7Threat Notifications and Protective Measures
Individuals receiving Apple's threat notifications are advised to seek expert help immediately. Those in Serbia can contact SHARE Foundation, while others may reach Access Now's Digital Security Helpline. Enabling Lockdown Mode and keeping devices updated are critical protective steps.
8Warning Signs for Democracy
This case highlights the dangerous proliferation of digital surveillance tools used to suppress dissent during election periods. We're witnessing an era where regimes with authoritarian tendencies increasingly employ sophisticated cyber tools to quell peaceful protests and manipulate democratic processes.