Serbian Activists Targeted by Advanced Spyware Ahead of Elections

In 2026, at least 14 individuals in Serbia, including student activists and opposition politicians, were targeted with advanced spyware, marking the largest documented wave of such surveillance in the country. The spyware, including NSO Group's Pegasus, was deployed using a zero-click exploit via iMessage, allowing attackers total access to the infected devices. The timing of these attacks coincided with local elections on March 29, 2026. Forensic analysis confirmed infections across December 2025 to January 2026, with Apple issuing high-confidence threat notifications to those targeted. The Foundation and Citizen Lab reported that some devices were also infected with a new version of NoviSpy, an Android spyware. The use of such spyware is illegal in Serbia, and the targeting highlights ongoing abuses of surveillance technology against pro-democracy movements. The situation remains critical as the forensic investigations continue.

Key Points: • At least 14 Serbian activists and politicians targeted with spyware ahead of elections. • Pegasus spyware was deployed using a zero-click exploit, allowing remote access to devices. • New version of NoviSpy spyware also detected, indicating evolving threats against opposition.