Targets identified: Foundation documented spyware targeting students, activists, opposition politicians, and a local councilor.
Apple alerts issued: Apple sent mercenary-spyware threat notifications to users in 110 countries on August 13.
Pegasus confirmed: Citizen Lab verified a zero-click Pegasus infection on a Serbian student activist’s iPhone.
At least 14 people linked to Serbia’s civil society and opposition have been targeted with advanced spyware since the beginning of 2026, according to digital rights group Foundation. The targeting comes after months of student-led protests and ahead of Serbia’s October 2026 parliamentary elections.
The campaign affected members of the student movement, activists, an opposition member of parliament, and a local councilor. Foundation described it as the largest documented wave of spyware surveillance in Serbia to date, with the findings emerging in August after several targets received Apple threat notifications.
Citizen Lab Confirms Pegasus Zero-Click Infection
The strongest technical confirmation comes from Citizen Lab at the University of Toronto, which analyzed forensic evidence from the iPhone of a member of Serbia’s student protest movement.
Researchers confirmed that the device was infected with Pegasus , the commercial spyware developed by Israeli company NSO Group . According to Citizen Lab senior researcher Bill Marczak, the infection occurred between December 2025 and January 2026 and involved an iMessage zero-click exploit.
Citizen Lab said Apple security updates have since neutralized the Pegasus implant identified in that case.
said another 11 people received Apple's high-confidence threat notifications, while its own forensic work subsequently confirmed two additional infections involving a new version of NoviSpy.
NoviSpy Found on Student Activists' Phones
confirmed one NoviSpy infection on the phone of a student movement member whose device had previously been confiscated during police questioning. Another device containing the spyware was linked to private Viber messages.
Apple Spyware Alerts Reached Users in 110 Countries
The Serbian findings followed a new round of Apple Threat Notifications issued on August 13. Apple confirmed that the latest alerts were sent to targeted users in 110 countries. Apple has used these notifications since 2021 to warn people it believes have been individually targeted by mercenary spyware .
Apple does not identify the specific spyware responsible for an individual notification. In the Serbian cases, however, forensic examination by Citizen Lab and provided additional evidence linking one device to Pegasus.
Election Timing Adds to Concern
said the spyware targeting coincided with Serbia's March 29 local elections in 10 municipalities and comes as the country approaches parliamentary elections scheduled for October.
Citizen Lab researcher John Scott-Railton said the findings and Apple's notifications indicate that members of Serbia's pro-democracy movement are being aggressively targeted with mercenary spyware ahead of the 2026 election cycles.
The available forensic findings confirm infections and targeting, but do not publicly establish who ordered or carried out the attacks.
What Targeted Users Should Do
Apple recommends that anyone receiving a threat notification take it seriously, keep devices updated, and use strong account protections. For people at elevated risk, Apple also recommends considering Lockdown Mode on supported devices.
The findings build on earlier investigations into NoviSpy, which researchers previously linked to spyware infections involving Serbian journalists, activists, and other civil society members.
The NoviSpy Android spyware was first publicly documented in Serbia in 2024, as Serbian Police unlocked a journalist’s phone via Cellebrite and planted the spyware.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
