EditSpyware wave hits Serbian student activists ahead of October elections
Digital rights groups confirm largest documented surveillance campaign against opposition figures
More than a dozen students, activists and opposition politicians in Serbia have been targeted with sophisticated spyware since the beginning of 2026, in what rights groups describe as the largest documented wave of such surveillance in the country. The SHARE Foundation reported that at least 14 individuals linked to the student-led protest movement, including one opposition member of parliament and a local councillor, had their devices compromised. Twelve of them received Apple threat notifications in August warning that their iPhones had been targeted by mercenary spyware.
Citizen Lab at the University of Toronto forensically confirmed that one student’s iPhone was infected with Pegasus, the powerful spyware developed by the Israeli company NSO Group. The infection occurred through a zero-click exploit in Apple’s iMessage, allowing the spyware to install itself without any action by the user. Indicators pointed to activity between December 2025 and January 2026. Amnesty International’s Security Lab separately verified that two Android devices carried a newer version of NoviSpy, a domestically produced surveillance tool first exposed in Serbia in 2024. In one of those cases, the software appeared after the phone was taken during a period of police detention.
Serbian authorities rejected the allegations. Parliament Speaker Ana Brnabić stated that there was no information that state institutions had used such software against students. The Serbian presidency and NSO Group did not immediately respond to requests for comment. The revelations arrive as President Aleksandar Vučić prepares for snap parliamentary elections scheduled for 25 October, a contest in which the student movement is widely seen as the strongest challenge yet to the ruling Serbian Progressive Party’s long dominance.
Pegasus and NoviSpy: how the targeting worked
Once installed, Pegasus can defeat encryption on modern smartphones, capturing messages from apps such as Signal and WhatsApp, along with photos, contacts, location data and other files. It can also activate the microphone and camera remotely. Clients of NSO Group have paid tens of millions of dollars for the technology, which has previously been used against politicians, journalists and activists in multiple countries. The United States blacklisted NSO under the Biden administration after the spyware was found on phones of U.S. embassy staff in East Africa.
NoviSpy, by contrast, typically requires physical access to the device for installation. Once present, it continuously collects data and can turn on the microphone or camera. One victim described noticing unusual battery drain and a changed battery icon after being detained for several hours in the run-up to the March local elections. Another became suspicious when private messages from their phone appeared to be referenced by a pro-government journalist on live television. SHARE Foundation’s analysis of one NoviSpy-infected device recovered more than 1,500 screenshots taken under remote command.
Ognjen Rašić, a 21-year-old communications student at the University of Niš and participant in the protest movement, received an Apple notification on 13 August. He described the discovery as producing a “strange feeling,” knowing that multimillion-dollar spyware had been used to extract information from his phone. He attributed the targeting to his involvement in election observation and local campaigning. Anja Despotović, another student activist in Belgrade, said her phone was later confirmed by Citizen Lab to have been compromised with Pegasus. She noted that her work involved ordinary democratic activities—speaking with citizens and students—that should not invite such intrusion.
John Scott-Railton of Citizen Lab said the fresh wave of Apple notifications showed that Serbia’s peaceful pro-democracy movement was being aggressively targeted with mercenary spyware ahead of key 2026 election cycles. He observed that NSO had spent a decade promising reform yet its product continued to serve as an instrument of political repression. The remaining eleven Apple-notified cases remain under analysis, though the notifications themselves are treated as high-confidence indicators of targeting.
From station collapse to political challenge
The student movement that now appears in the crosshairs of these surveillance tools grew out of public outrage following the collapse of a railway station concrete canopy in Novi Sad in November 2024, which killed 16 people. What began as demands for a transparent investigation into the tragedy and the corruption it symbolised evolved into sustained protests calling for accountability and early elections. The movement has operated largely without traditional party structures, relying on plenums and grassroots organisation, and has drawn tens of thousands onto the streets at key moments.
Vučić, who has led Serbia as ruling-party chair, prime minister and then president since 2012, has consolidated power over more than a decade. Critics accuse his government of eroding institutional checks, while supporters credit it with economic stability and infrastructure projects. Local elections held in March 2026, viewed as a test of the student-backed opposition’s organisational strength, were accompanied by reports of irregularities, violence and intimidation. The ruling party retained control in those contests.
Analysts note that independent polling remains limited, yet the student movement is widely regarded as the most significant opposition force, with traditional parties struggling for relevance. Milos Damnjanovic of the BIRN consultancy observed that the students appear to be on a comparable footing with Vučić and constitute the largest opposition bloc. Andrijana Ristić of the SHARE Foundation argued that the spyware campaign undermined any prospect of a level playing field, especially at a politically sensitive moment when the opposition stood a real chance of success in the October vote.
Previous surveillance against journalists, activists and civil-society figures in Serbia had been documented, yet the current cases represent the broadest pattern identified to date. The combination of commercial mercenary spyware such as Pegasus and a domestically developed tool like NoviSpy underscores both the technical sophistication available and the willingness to deploy it against a non-violent protest movement. With parliamentary elections set for 25 October, the findings raise sharp questions about the integrity of the political process and the boundaries of state power in Serbia’s digital sphere.
Sources: The CitizenLab, N1, BETA, The Financial Times
Caption: Students march with banners during a mass student-led anti-government rally in Belgrade, Serbia, 23 May 2026. Thousands gathered to ramp up pressure on the government and demand early parliamentary elections. The political movement originally erupted across the country following the November 2024 canopy collapse at the Novi Sad railway station that killed 16 people. EPA/ANDREJ CUKIC
Updated: September 3, 2026 - 10:36
