Pegasus Spyware Targets Activists in Serbia's Largest Documented Espionage Wave

At least 14 activists in Serbia have been targeted by sophisticated spyware this year, marking the largest documented espionage operation of its kind in the country, according to a report by The Guardian and the digital rights group "Share Foundation". The targeting attempts were revealed in August after Apple sent alerts to users in 110 countries warning of potential spyware attacks on their devices. Analysis by Citizen Lab, a digital security research center, indicated that one of the targeted individuals in Serbia was subjected to an attempted hack using Pegasus spyware, developed by the Israeli firm NSO Group.

The Share Foundation stated that the list of targets included members of the Serbian student movement, which has become a significant opposition force against President Aleksandar Vučić's government. The movement's activity intensified following a deadly train station roof collapse in Novi Sad in November 2024, which killed 16 people and sparked widespread anti-government and anti-corruption protests, largely led by university students. Vučić, who has held top leadership positions for over a decade, faces accusations from opponents of weakening state institutions, restricting freedoms, and consolidating political power, while maintaining close ties with Moscow. Serbian authorities deny these allegations.

While no direct evidence has yet linked Vučić's government to the Pegasus targeting of a student, previous reports have connected Serbian security agencies to another spyware, "Novi Spy," used against students and activists. Ana Brnabić, the Speaker of the Serbian Parliament and a member of the ruling Serbian Progressive Party, has denied government involvement in spying on students and publicly questioned the targeting claims.

The Share Foundation suggests the timing of these attacks, coinciding with local elections in March, may indicate a testing phase for espionage tools before larger electoral events. Serbia is preparing for early parliamentary elections in October, with Vučić announcing the vote will occur on the 18th or 25th of the month, amidst ongoing anti-government protests. A Citizen Lab researcher told The Guardian that forensic analysis suggests Serbia's pro-democracy civil movement has faced extensive targeting by commercial spyware ahead of significant elections in 2026.

Among those targeted was student Milica Popović, who described the potential phone hack as a severe violation of her privacy but affirmed it would not deter her activism. Pegasus is a well-known and controversial commercial spyware, with investigations revealing its use by governments to target journalists, human rights defenders, and political dissidents globally. The U.S. has blacklisted NSO Group, and the company faces lawsuits related to its spyware's use against WhatsApp users and other Meta services.