Earlier this year, Serbia experienced its largest documented spyware campaign targeting at least 14 individuals across civil society, including members of a prominent student protest movement, according to the digital rights organization Share Foundation and forensic analysis by the Citizen Lab.
The spyware used in the attacks was identified as Pegasus, developed by NSO Group, which has been linked to authoritarian surveillance worldwide. Victims were notified in August following an alert from Apple, which informed people in 110 countries that they may have been targeted by mercenary spyware.
Targets Include Student Movements Resisting Government
The Share Foundation reported that those infected included members of a Serbian student movement that emerged after a tragic train station collapse earlier this year. The movement, one of the largest student protests in Europe, has consistently challenged the government of Aleksandar Vučić since 2024.
Vučić’s government has denied any involvement in the spyware targeting. Ana Brnabić, parliamentary speaker and a senior figure in the ruling Serbian Progressive party, rejected the claims in an interview with Euronews Serbia TV, asserting, “Absolutely not. I do not believe a single word they’ve [students, Share] said.” Meanwhile, no evidence has publicly linked the Serbian government directly to the attacks.
Political Context and Timing Suggest Election-Related Motives
The wave of infections coincided with local elections in March and preceded snap elections scheduled for October 2024, leading Share to speculate the spyware operation served as a testing ground for monitoring opposition and student activists. Andrijana Ristic, a policy adviser at Share, suggested the ruling party may have been assessing the spyware’s capabilities and its pressure over dissenters.
John Scott-Railton, senior researcher at the Citizen Lab, emphasized the political implications, stating, “Our forensic findings, and this fresh wave of Apple threat notifications reveal that Serbia’s peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles.” This prescience about coming election cycles underscores the ongoing surveillance risks faced by activists.
Victims Voice Concern but Stand Firm
Milica Popović, a student activist who was targeted, described the attack as “cruel,” expressing distress at the invasion of her private digital space without her knowledge. Despite this, she affirmed that such attempts will not deter her or the movement. “If their intention was to frighten us, or make us stop, it will not work,” she said.
Controversy Surrounds NSO Group and Pegasus
NSO Group, originally an Israeli company closely tied to military interests, now under U.S. ownership, markets Pegasus as an “ethical spyware company” while facing scrutiny due to its technology’s use in surveillance of journalists, human rights defenders, and political dissidents.
NSO is permanently banned by a U.S. court from targeting WhatsApp and Meta products and is reportedly seeking ways to enter the U.S. market. The recent Serbian attacks raise questions about the company’s reform claims. Citizen Lab’s Scott-Railton criticized the ongoing use of Pegasus, stating, “Today, Pegasus is still being used to hack people campaigning for democracy. NSO spent a decade promising reform, yet their spyware is still an instrument of political repression.” NSO Group was contacted for comment but no public statement has been released.
