SERBIA: Student democracy activists targeted with spyware

A spyware campaign has targeted activists and civil society figures from the anti-government student movement and opposition politicians in Serbia. According to findings by the digital rights organisation SHARE Foundation and verified by two of the world’s leading digital forensics teams, the Citizen Lab at the University of Toronto and Amnesty International’s Security Lab,at least 14 people were targeted with advanced spyware since the beginning of 2026, coinciding with the local elections held on 29 March 2026. This represents the largest documented wave of surveillance ever seen in the country.

It has been confirmed that at least one of the students’ phones was infected with Pegasus, a highly intrusive and illegal spyware developed by the Israeli company NSO Group that gives a hacker total access to the device, including the ability to secretly record the screen or activate the microphone and camera, without the user knowing or having to first click on a compromised link. The spyware has been used by state actors in several recorded attacks against journalists, human rights defenders, activists and dissidents around the world, such as Morocco, Poland, Saudi Arabia, Spain and Mexico.

There have been almost continuous anti-corruption mass protests in Serbia since the collapse of the railway station canopy in Novi Sad in November 2024, in which 16 people died — a tragedy widely linked to corruption and government failure. That movement has grown into one of the most significant civic mobilisations in Serbian history, with young people at its centre, opposing President Aleksandar Vučić’s government.

No state actor has been formally identified as responsible for deploying the spyware. The parliamentary speaker and senior member of the ruling Serbian Progressive Party denied the use of such software against the opposition and civil society. However, the targeting of journalists and anti-government activists with spyware, including software called NoviSpy, has been documented before and linked to state authorities and Vučić’s government. The findings show that the latest cases are not isolated incidents but part of a broader digital surveillance infrastructure.