Large group of Serbian opposition, activist figures targeted with spyware

At least 14 Serbians, including a member of Parliament and student protesters, have been targeted with advanced spyware since December 2025. The SHARE Foundation, in collaboration with Amnesty International and Citizen Lab, uncovered the targeting, with evidence suggesting the spyware was used to monitor activists and suppress dissent, particularly in the lead-up to local elections held in March and anticipated parliamentary elections in October. The timing of the spyware targeting and infections coincided with local elections, where student protesters were actively organizing to oust the increasingly authoritarian ruling party.

Two different types of spyware were found on the victims’ phones: the NoviSpy and Pegasus tools. Forensic research is ongoing for 11 additional phones whose owners were alerted by Apple to likely malicious activity. One of the confirmed NoviSpy victims’ text messages were read live on a Serbian television network friendly with the ruling party, according to the SHARE Foundation.

Experts at Citizen Lab confirmed that a student protester’s phone was infected with zero-click Pegasus spyware between December 2025 and January 2026. NoviSpy, a new form of Android spyware, was used in at least two cases, according to Amnesty International. Amnesty International reported that Cellebrite, whose software allows governments to break into and extract data from phones, cut ties with Serbia after an Amnesty report documenting the use of NoviSpy to target dissidents and journalists whose phones were taken while in government custody. Police never asked detainees for their passwords and instead broke into them using Cellebrite, Amnesty said, and from there implanted the spyware.

NoviSpy requires authorities to physically access the phone to embed the spyware, whereas Pegasus can infiltrate phones without the phone ever being seized. As a result, many of the NoviSpy infections found in Serbia have been discovered after victims were detained by authorities who took their phones during questioning.

Serbian authorities reportedly denied the accusations, with the country’s intelligence agency, known as BIA, calling the claims, “nothing more than trivial sensationalism.” Opposition Serbian parliamentarian Radomir Lazović came forward to reveal his phone was one of the 14 targeted with spyware.

“The spyware is a strong indicator that our government is very afraid of us,” said Ognjen Rašić, a student protester whose phone is still being studied by researchers. “They are ready to use whatever it takes to sabotage us because we're currently the strongest and the most influential political force in Serbia.”

Suzanne Smalley is a reporter covering digital privacy, surveillance technologies and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.