Sept 2 (Reuters) - At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday.
By AJ Vicens
The wave of spyware infections, discovered in August after Apple AAPL.O notified people in 110 countries they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement.
The incident offers a window into the use of powerful and invasive spyware aimed at students and political opposition members amid contentious elections, with national polls looming.
Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, SHARE said. At least one device was targeted with Pegasus, made by Israeli company NSO Group, and at least two devices were targeted with malware similar to NoviSpy, first exposed by Amnesty International in Serbia in December 2024.
At a news conference in Belgrade, a student activist who only identified herself as Milica said she received a notification her phone was infected in mid-August.
"They could access the microphone and camera on the phone and turn them on while we shower or speak about private matters. It's not normal to do that; it's not normal that we don't have the right to privacy," she said.
Reuters could not determine who was responsible for the alleged infections. NSO has said it only sells to governments. Neither the Serbian government nor NSO Group responded to requests for comment. In a report published in January, NSO Group said it would work with clients to address potential violations.
LOCAL ELECTIONS SEEN AS TEST
In one incident, a device associated with a member of the student movement was targeted with a zero-click version of Pegasus, meaning it did not require user interaction to deploy on the device. NoviSpy was found on the phone of a student movement member whose device had previously been taken away during police questioning, according to SHARE.
The targeting coincided with the March 29 local elections held in 10 municipalities, according to SHARE, which said they were seen as a test of how student-backed political opposition groups could organize and compete against ruling party politicians.
"These new forensic findings show that Serbian student activists continue to be targeted with invasive spyware,” said Donncha Ó Cearbhaill, head of Amnesty International's security lab, which helped investigate the infections.
In a post on the social media site X, U.S. Representative Joe Wilson, a South Carolina Republican, criticized the Serbian government, saying "totalitarian technology is being weaponized against a free people demanding the rule of law."
In Belgrade, Ana Toskic Cvetinovic, a legal expert with the Partneri Srbija rights watchdog, said use of such software without judicial authorization constitutes a crime under Serbian laws.
"There must be a reasoned court decision," said Toskic Cvetinovic. "To our knowledge, there is no such thing here."
The Pegasus implant was put on at least one student's phone between December 2025 and January 2026, according to Bill Marczak, a senior researcher at the Citizen Lab, a Canadian internet watchdog group which is also investigating the infections. Apple's security updates have since neutralized the spyware, Marczak said.
John Scott-Railton, another senior researcher with Citizen Lab, said his organization's findings and Apple's notifications "reveal that Serbia's peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."
NSO was blacklisted by the U.S. government in 2021 over concerns about rights abuses. In 2025, an American investment group acquired the company, although it is still operating out of Israel and under Israeli regulations.
In a statement, Apple said it sent threat notifications on August 13 to targeted users in 110 countries, adding that to date, it has notified users in more than 150 countries overall.
(Reporting by AJ Vicens in Detroit; Additional reporting by Ivana Sekularac and Aleksandar Vasovic in Belgrade and Raphael Satter in Washington; Editing by Thomas Derpinghaus and Tom Hogue)
