Students and opposition activists targeted with spyware in Serbia

More than a dozen students and opposition members in Serbia have been targeted with spyware since the start of the year in the largest documented wave of such surveillance in the eastern European country.

In at least one case, authenticated by digital investigators in Canada, a student activist’s phone was infected remotely with Pegasus spyware developed by the Israeli company NSO. In another case, a domestically produced surveillance software known as NoviSpy was allegedly installed on the target’s device while the person was held in police custody.

The latest revelations about the use of spyware against Serbian opposition figures and activists come as strongman President Aleksandar Vučić prepares to hold highly-charged parliamentary elections in October, when Serbia’s powerful student protest movement is expected to pose the biggest threat to the ruling party’s grip on power.

Journalists, activists and civil society members have been targeted with surveillance technologies in the past, but the new cases represent the most widespread use of spyware in Serbia identified to date, according to the Serbian human rights group SHARE Foundation, which has documented 14 cases this year.

In 12 of the cases, the targets contacted SHARE after they received threat notifications from Apple in August that their iPhones had been compromised.

Toronto-based Citizen Lab, which has so far analysed one of those cases, said that the device had been infected with Pegasus via a “zero-click exploit” in Apple’s iMessage, meaning the spyware was installed without the target clicking a link or taking any other action. Apple’s latest software updates were believed to have patched the vulnerability, Citizen Lab added. The other 11 cases are still being analysed.

Once installed, NSO’s Pegasus defeats nearly all the encryption on modern smartphones by transmitting a mirror of the phone’s contents, including messaging apps such as Signal and WhatsApp, to its customers.

Those clients pay tens of millions of dollars to buy the technology, which has been used to target politicians, activists and journalists in dozens of countries, including Hatice Cengiz, the fiancée of assassinated Saudi journalist Jamal Khashoggi.

Under the Biden administration, NSO was blacklisted by the US Department of Commerce from doing business with any American company, after its spyware was found on the phones of US embassy employees in east Africa.

“This fresh wave of Apple Threat Notifications reveal that Serbia’s peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles,” said Citizen Lab’s John Scott-Railton.

The Serbian presidency and NSO have both been approached for comment.

Ognjen Rašić, a 21-year-old communications student at the University of Niš received an Apple notification on August 13. It was a “strange feeling” to know that someone had used multimillion-dollar spyware to scrape information from his phone, he told the FT.

A member of the student protest movement, Rašić suspected the Serbian government was behind the spyware attack and had targeted him because of his involvement in election observation and campaigning for local elections in March. “They’re afraid because, according to independent polls, the student movement is the most influential political force in Serbia and they are frightened by that,” he said.

In two other cases, Serbia’s so-called NoviSpy software was used to compromise devices running Android operating systems, according to SHARE. First publicised in a 2024 Amnesty International report that described Serbia as a “digital prison”, NoviSpy needs to be physically installed but will then continuously collect data and can be used to turn on the phone’s microphone or camera remotely.

One of those victims told the FT they noticed their phone was behaving strangely after they were unlawfully detained by police for several hours in the run-up to the March polls. After noticing that the device was rapidly running out of charge and that its battery symbol appeared different, they contacted SHARE, which helped confirm the presence of NoviSpy on the operating system, the person said, asking not to be identified for security reasons.

The other victim became suspicious after private messages from their phone were discussed by a well-known journalist on a live television broadcast, according to SHARE.

“You know that we monitor their closed WhatsApp and Viber groups,” Dragan Vučićević, editor-in-chief of the pro-government Informer, says in a video clip seen by the FT. “How we managed to do that, we’re not going to tell you.”

President Vučić, a founder and longtime leader of the ruling Serbian Progressive Party, has gradually consolidated his control of the country, first as ruling party chair from 2012, as prime minister from 2014, and then as president from 2017.

The student movement emerged from mass protests that engulfed the country after a train station canopy collapsed in the northern Serbian city of Novi Sad, killing 16 people.

Milos Damnjanovic, an analyst with the BIRN consultancy in Belgrade — some of whose associates have also been targeted by Pegasus — said it was clear that the student movement represented by far the clearest challenge to the ruling party.

“We are in the absence of reliable polling data but the students do seem to be on par with Vučić,” he said. “They are the biggest opposition bloc, the rest of the opposition is fighting for survival.”