Serbian Activists Targeted by Advanced Spyware Ahead of Elections

Since December 2025, at least 14 individuals in Serbia, including student activists and opposition politicians, have been targeted with advanced spyware, marking the largest documented wave of such surveillance in the country. The attacks coincide with local elections held on March 29, 2026, and are linked to the use of NSO Group's Pegasus spyware via a zero-click exploit targeting iMessage. Forensic investigations by Citizen Lab and the Foundation confirmed the infections, which were revealed after Apple issued threat notifications to users in 110 countries. Additionally, a new variant of Android spyware, NoviSpy, was identified on some devices. Serbian authorities have denied the allegations, labeling them as sensationalism. The situation raises concerns about the safety of civil society and the pro-democracy movement in Serbia as parliamentary elections approach in October 2026.

Key Points: • At least 14 Serbian activists and politicians targeted with spyware since December 2025. • Pegasus spyware was delivered via a zero-click exploit on iMessage, confirmed by forensic analysis. • Serbian authorities denied involvement, calling the allegations trivial sensationalism.