AINEWS
Citizen Lab confirmed Pegasus, commercial spyware sold to governments that gives total device access, on a Serbian student activist's phone. The finding lands weeks before October's snap vote.
On Wednesday, Citizen Lab confirmed that at least one Serbian student activist was infected with Pegasus, the commercial spyware made by Israel's NSO Group, the same category of tool that has been used against journalists and dissidents from Mexico to Saudi Arabia. The forensic confirmation lands weeks before Serbia's October snap elections, and it follows a Share Foundation finding that at least 14 people across the country's civil society were targeted earlier in 2026 with what researchers are calling Serbia's largest documented wave of mercenary spyware.
Mercenary spyware is a category of commercial hacking tool sold to governments that gives the operator total access to a phone: messages, camera, microphone, location, and the contents of encrypted apps. Citizen Lab, the University of Toronto spyware research group that produced the forensic report, said the Pegasus infection on the Serbian device gives the attacker just that level of control. Apple began warning affected users in August as part of a notification round that covered 110 countries, and Share Foundation flagged the Serbia cluster.
The students are the same people who filled Serbia's streets after the 2024 collapse of a railway station canopy in Novi Sad, a disaster that killed 15 and turned into a year of countrywide protests. One of them, Milica Popović, is among the targets, and Share Foundation's Andrijana Ristic described the wave as the country's most extensive documented surveillance operation to date. "This is the largest documented wave of surveillance in Serbia so far," Ristic said.
Beyond Pegasus, a second spyware tool called NoviSpy was deployed against the same students. NoviSpy has been previously linked to Serbian authorities, a distinction the Guardian's reporting makes explicit: while the NoviSpy connection is documented, the paper reports there is no evidence that the government of President Aleksandar Vučić was the entity that targeted the Pegasus-infected student. The reader should hold both findings separately. One tool has a known operator. The other does not, in the public record.
Serbia's election calendar makes the timing hard to ignore. March 2026 local elections were the first nationwide vote since the protests, and Share Foundation called the surveillance a possible test run for October's snap parliamentary elections. "The local elections were basically used as a test for the ruling party to see [the spyware's] strengths, but also to see the amount of pressure they are able to exert over the students and the opposition," Ristic said. Citizen Lab senior researcher John Scott-Railton made the same point: "Our forensic findings, and this fresh wave of Apple threat notifications reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."
The Serbian government has been in power for more than a decade under Vučić, and critics say institutions have been hollowed out as the country has drifted closer to Moscow. On Wednesday, Ana Brnabić, the parliamentary speaker and a senior member of the ruling Serbian Progressive Party, denied the surveillance in an interview with Euronews Serbia TV. Asked whether the government was behind the targeting, Brnabić said: "Absolutely not. I do not believe a single word they've [students, Share] said."
Serbia's snap elections are scheduled for October. The forensic record already shows Pegasus on at least one activist's phone and NoviSpy on others, with Apple warnings in a round that covered 110 countries. The remaining question is attribution: who is the customer, and what is named by the time voters go to the polls.