- summary
- The largest documented wave of spyware targeting in Serbia to date. Around the 29 March 2026 local elections in 10 municipalities, at least 14 people — student movement members, activists, opposition members of parliament and a local councillor — were targeted with mercenary and domestically developed spyware. It came to light after Apple's threat notifications of 13 August 2026. Citizen Lab confirmed a zero-click Pegasus (NSO Group) infection of a student movement member (December 2025 – January 2026; patched in iOS 18.4.1). SHARE Foundation and Amnesty International's Security Lab found a new version of the domestically developed NoviSpy Android spyware on at least two devices, one on the phone of a student activist that authorities had taken during police questioning. Findings were made public at the students' press conference of 2 September 2026. No operator is formally attributed; the Security Information Agency (BIA) called the claims 'trivial sensationalism', President Vučić dismissed them, and Parliament Speaker Ana Brnabić said she did not believe 'a single word'. Legal experts note that secret surveillance without a reasoned court decision is a crime under Serbian law.
- country
- Serbia
- date text
- 12/2025
- entities
- Unattributed operator; forensic findings point to state-linked surveillance (NoviSpy previously tied to Serbian authorities, Amnesty Dec 2024). Denials: BIA, President Aleksanda…
- entity type
- Security Apparatus (suspected, unattributed)
- id
- 1145
- name
- Unattributed operator; forensic findings point to state-linked surveillance (NoviSpy previously tied to Serbian authorities, Amnesty Dec 2024). Denials: BIA, President Aleksandar Vučić, Parliament Speaker Ana Brnabić
- role
- actor
- At least 14 people: members of the student protest movement, civil society activists, an opposition member of parliament and a local opposition councillor (names withheld at the…
- entity type
- Movement; Individual — Student / Activist / Opposition politician
- id
- 1146
- name
- At least 14 people: members of the student protest movement, civil society activists, an opposition member of parliament and a local opposition councillor (names withheld at their request)
- role
- target
- Unattributed operator; forensic findings point to state-linked surveillance (NoviSpy previously tied to Serbian authorities, Amnesty Dec 2024). Denials: BIA, President Aleksanda…
- sources
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Security Apparatus Enforcement
- label
- Security Apparatus Enforcement
- code
- TC-20
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- campaign ids
- campaign phase
- Phase 5: Systemic Assault
- channels
- Covert digital surveillance (zero-click spyware); device seizure during police questioning
- civic response
- SHARE Foundation's digital forensics investigation with Citizen Lab and Amnesty International's Security Lab; students publicised the findings at a press conference (2 September 2026). UN experts warned that spyware use against opposition and dissenting voices undermines election quality and called on Serbia to stop it before the 25 October 2026 parliamentary elections (OHCHR, September 2026).
- consequence category
- Operational Suppression
- created at
- 2026-09-24T23:42:11.063815+00:00
- date precision
- month
- escalation
- 5
- harm track
- Track 3 — Operational Suppression
- id
- SRB-121
- institutional consequence
- Chilling effect; Data seizure/exposure; International response (UN experts, September 2026)
- notes
- Coded Sep 24 2026. First use of TC-21 in the database. Secondary TC-20: the NoviSpy infection followed device seizure during police questioning (UN experts: spyware 'allegedly installed covertly during police interviews or arbitrary detentions'). Narrative frame left blank: no delegitimising narrative is attached to the attack itself; the state response is denial. Timing tied to the 29 March 2026 local elections and the run-up to 25 October 2026 parliamentary elections. Related: SRB-122 (Amnesty's December 2024 findings on NoviSpy/Cellebrite use by police and BIA) and its outcome CR-SRB-001 (Cellebrite suspended use in Serbia, Feb 2025). Related signal: SIG-SRB-097 (BCSP report on spyware, 2026). Date range: infections December 2025 – March 2026 (around the 29 March 2026 local elections); disclosed 2 September 2026. Escalation 5: forensically confirmed infection (Citizen Lab, Pegasus; NoviSpy on two devices). (Spyware thresholds, Sep 25 2026.) Apple notifications of 13 Aug 2026 (110 countries) led to the discovery (Reuters). UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).
- occurred on
- 2025-12-01
- response ids
- trigger type
- TR-04: Electoral Event
- updated at
- 2026-09-25T14:48:22.09129+00:00
- version
- 6
The public research collection