More than a dozen Serbians targeted with mercenary spyware, digital rights group says

At least 14 individuals from Serbia's civil society were targeted with sophisticated spyware shortly before local elections in March, according to the digital rights group SHARE Foundation. This marks the largest documented wave of such infections in Serbia, as discovered in August. The SHARE Foundation identified victims among student movement members, activists, opposition party members in parliament, and a local councilor.

Some devices were infected with Pegasus spyware from the Israeli company NSO Group, while others were targeted with malware similar to NoviSpy, first detected by Amnesty International in December 2024. One student activist, who spoke on condition of anonymity, reported receiving a notification that her phone was infected in mid-August.

The spyware could access the microphone and camera, recording private conversations without the victim's knowledge or consent. Apple notified users through security updates in August but could not determine who was responsible for the infections. NSO Group, which only sells to governments, neither commented nor responded to the allegations.

The targeting coincided with the March 29 local elections in Serbia, seen as a test for student-backed political opposition groups. U.S. Representative Joe Wilson criticized the Serbian government for weaponizing totalitarian technology against free people demanding the rule of law. Amnesty International's head of their security lab, Donncha Ó Cearbhaill, stated that Serbian student activists continue to be targeted with invasive spyware.

A legal expert from Partneri Srbija rights watchdog, Ana Toskic Cvetinovic, emphasized that the use of such software without judicial authorization constitutes a crime under Serbian law.