Spyware targeted Serbian student activists and politicians involved in anti-corruption protests against President Aleksandar Vucic ahead of local elections in March, a new report claimed.
At least 14 people were affected by the intrusions in early 2026, marking the largest documented wave of such tactics in the country, according to a report published on Sept 2 by Share Foundation, a Serbian human rights group. In at least one case, the hack used notorious government-grade spyware sold by the Israeli company NSO Group, the researchers said.
The alleged use of spyware comes as Vucic’s decade-long dominance in Serbian politics has been rocked by massive street rallies led by the student movement, accusing him of anti-democratic methods and corruption. The president refutes the allegations, calling the protests a foreign-funded plot to destabilise the country. A showdown is expected in snap elections for Serbia’s 250-seat parliament next month, where the top contenders are Vucic’s centre-right Progressive Party and a still undisclosed group of independent candidates endorsed by the students.
What began as an ad-hoc group channelling public outrage over a deadly train station collapse in November 2024 has become a major grassroots campaign, following years of lacklustre showings by opposition parties.
A dozen people, including student organisers and two opposition politicians, contacted Share after receiving notifications from Apple Inc on their iPhones that they were targeted by spyware, according to the report. Canadian digital rights group Citizen Lab and Amnesty International’s Security Lab independently confirmed Share’s findings, it said.
Several of the spyware intrusions appear to have occurred around the time of local elections in March and represent a climate of increasing political repression in Serbia, according to Andrijana Ristic, a policy adviser at Share. She added that she believes the Serbian government was likely responsible for the breaches.
"It’s a very sensitive political time in Serbia, and there is a real chance the student movement and the opposition will be able to win the elections” in October, she said. "But you cannot have a level playing field in the elections if one side is illegally obtaining information on the other.”
Serbia’s government did not immediately respond to a request for comment.
Anja Despotovic, a student in Belgrade who is involved in the protest movement, said she had received a notification from Apple in March that she had been targeted by spyware. Her phone was subsequently analysed by Citizen Lab, which confirmed her phone had been hacked using NSO Group Pegasus spyware.
"My work in the movement involves talking to citizens, students and participating openly, activities that should be completely normal in democratic society,” Despotovic said.
NSO Group supplies its spyware, which is used to covertly hack phones and snoop on communications, to governments and law enforcement agencies, ostensibly for the purpose of tracking down serious criminals. However, security researchers have persistently found it has been used to monitor political opponents and journalists.
The US sanctioned NSO Group in 2021, accusing the company of supplying spyware to foreign governments to "maliciously target” government officials, journalists, businesspeople, activists, academics and embassy workers.
Last year, NSO’s Israeli founders agreed to sell the company to a group of US investors led by Hollywood producer Robert Simonds, the Wall Street Journal reported.
John Scott-Railton, a senior researcher at Citizen Lab, said the discovery of NSO’s spyware in Serbia came 10 years after the company’s technology was first identified targeting an activist in the United Arab Emirates.
"NSO spent a decade promising reform, yet their spyware is still an instrument of political repression,” he said.
NSO didn’t respond to a request for comment. – Bloomberg
