At Least 14 Serbians Targeted in Spyware Campaign, Digital Rights Group Says

At least 14 people involved in Serbian civil society were targeted by advanced spyware earlier this year, according to the digital rights organization Share Foundation. The group described the incidents as the largest documented wave of spyware infections in Serbia to date. The suspected attacks came to light in August, after Apple notified people in 110 countries that they may have been targeted by mercenary spyware. Share said those affected in Serbia included members of a student protest movement that has opposed Aleksandar Vučić’s government since 2024. The Citizen Lab, which conducts forensic examinations of spyware attacks, reported on Wednesday that at least one Serbian target had been infected with Pegasus, spyware made by the NSO Group. The software would have given an attacker extensive access to the person’s device, according to the researchers. The student movement grew out of nationwide protests following the collapse of a train station during the previous winter. It has since become one of Europe’s largest student movements, according to the report. Share pointed to the timing of the suspected surveillance, during local elections in March, and suggested that the activity may have been used to test the spyware before snap elections scheduled for October. That interpretation came from the organization, not from an established finding about who carried out the attacks. There is no evidence in the source material that Vučić’s government was responsible. Ana Brnabić, Serbia’s parliamentary speaker and a senior member of the ruling Serbian Progressive party, denied that students had been spied on. Speaking to Euronews Serbia, she said she did not believe the allegations made by the students or Share Foundation. Milica Popović, a student identified as one of the targets, said the possibility that someone had entered her private digital space without her knowledge made her feel exposed. She added that the incident would not deter her or the wider movement. Pegasus has previously been used to target journalists, human rights advocates and dissidents, according to the report. The NSO Group was approached for comment. It remains unclear whether the suspected Pegasus attack was carried out through WhatsApp.