IC Technology & Cyber — 2026-09-03

Pegasus and NoviSpy Variant Spyware Found on Devices of 14 Serbian Activists in Largest Documented Wave

BLUFRecurring state-linked spyware deployments against Serbian civil society have normalized digital surveillance as electoral-cycle infrastructure, leaving opposition networks presumed-compromised through October parliamentary elections.

The SHARE Foundation reported on Wednesday that 14 people in Serbia's civil society, including an opposition member of parliament and a local councilor, had been targeted with mercenary spyware ahead of the March 29 local elections, calling it the largest documented wave of such infections in the country to date NoviSpy variant spyware found on devices of Serbian activists" data-source="CyberScoop" data-url="https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/" data-rt="secondary" data-otype="trade_press">12. The Citizen Lab confirmed with high confidence that a student protest movement member's iPhone was infected via an iMessage zero-click exploit deploying NSO Group's Pegasus spyware between December 2025 and January 2026, an exploit Apple has since patched 3. Amnesty International separately confirmed a new NoviSpy variant on two devices, including one belonging to a student whose phone was seized during police questioning 12. Discovery followed Apple's August 13 threat notifications sent to targets in 110 countries 2, and SHARE Foundation and Amnesty International both said available evidence points to Serbian police or security services in the NoviSpy cases 1. SHARE Foundation said the targeting also spans the run-up to Serbia's snap October parliamentary elections, not just the March local vote, amid a wider protest movement traced to the 2024 Novi Sad railway station canopy collapse 1.

Analysis
Mercenary spyware has become a standing feature of Serbia's electoral cycle rather than an isolated incident, raising operational risk for opposition figures and student organizers heading into October's snap parliamentary vote. Citizen Lab's forensic confirmation of the patched iMessage exploit and the SHARE Foundation investigation underpinning it form the core evidentiary chain, with CyberScoop, Bloomberg, and AP amplifying rather than independently corroborating. Amnesty's tie of a new NoviSpy variant to a phone seized in police custody extends the pattern of state-security use against civil society, though that attribution remains circumstantial, resting on custody timing and a pro-government outlet's leaked messages rather than technical attribution to a specific operator. Absent oversight changes, digital-rights groups and diaspora contacts should treat any device linked to the protest movement as presumed-compromised through the next election cycle.

4 sources

Pegasus, NoviSpy variant spyware found on devices of Serbian activists - CyberScoop
More than a dozen Serbians targeted with mercenary spyware, digital rights group finds - Associated Press (via Yahoo News)
Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist - The Citizen Lab
Spyware Targeted Serbian Protest Organizers' Phones, Report Says - Bloomberg