{"id":"serbia-pegasus-novispy-surveillance-sep-2026","category":"breach","status":"closed","title":"Pegasus and NoviSpy infections target Serbia’s pro-democracy movement","tldr":"Pegasus and NoviSpy-related spyware compromised Serbian activists’ phones. Later findings extended to a university rector. Update devices, enable iPhone Lockdown Mode if at risk, and get expert help immediately after a spyware alert.","summary":"Investigations published on 2 September confirmed spyware attacks against Serbia’s pro-democracy movement. Citizen Lab found Pegasus on a student activist’s iPhone, with infection indicators spanning December 2025–January 2026. The iMessage attack required no interaction and could expose messages, photos and other private data, alongside microphone and camera access. SHARE Foundation separately confirmed two NoviSpy-related infections and documented at least 14 people targeted, including students, activists and opposition politicians. Apple alerts indicated targeting, not forensic confirmation of every infection. Citizen Lab believed the student’s exploit had been blocked by iOS 18.4.1; this was not an all-clear for the wider campaign or infected devices. On 6 October, SHARE reported a criminal complaint over student Jelena Kontić’s Pegasus infection. On 19 October, Citizen Lab confirmed rector Vladan Đokić’s infection, bringing its count to at least 16 people targeted or infected. Analysis of prosecutorial associate Rade Bajić’s device continued. SHARE reported no effective action on existing complaints; the reviewed sources provide no subsequent resolution through 3 November.","action":"Keep phones updated; if you face targeted surveillance, enable iPhone Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then restart as prompted. Verify any Apple threat alert by signing in directly at account.apple.com and immediately contact SHARE Foundation in Serbia or Access Now’s Digital Security Helpline. Ask those experts about screening close family members and collaborators too.","product":"Apple iPhone and Android phones targeted with Pegasus and NoviSpy-related spyware","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["serbia","pegasus","novispy","spyware","iphone","android","targeted-surveillance"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"About Apple threat notifications and protecting against mercenary spyware","url":"https://support.apple.com/en-au/102174","by":"Apple","date":"2026-08-13"},{"kind":"advisory","title":"About Lockdown Mode","url":"https://support.apple.com/en-au/105120","by":"Apple","date":"2026-09-18"},{"kind":"research","title":"Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist","url":"https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/","by":"Citizen Lab","date":"2026-09-02"},{"kind":"research","title":"SHARE Foundation: Students and Opposition Politicians Targeted by Spyware","url":"https://sharefoundation.info/en/share-foundation-students-and-opposition-politicians-targeted-by-spyware/","by":"SHARE Foundation","date":"2026-09-02"},{"kind":"news","title":"BIA on students and opposition targeted by spyware: “Purely trivial sensationalism, we respect the law”","url":"https://n1info.rs/english/news/bia-on-students-and-opposition-targeted-by-spyware-purely-trivial-sensationalism-we-respect-the-law/","by":"N1","date":"2026-09-03"},{"kind":"post","title":"Criminal Complaint Filed Over Spyware","url":"https://sharefoundation.info/en/criminal-complaint-filed-over-spyware/","by":"SHARE Foundation","date":"2026-10-06"},{"kind":"research","title":"Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures","url":"https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/","by":"Citizen Lab","date":"2026-10-19"},{"kind":"post","title":"New Spyware Cases: University of Belgrade and Prosecutor’s Office Targeted","url":"https://sharefoundation.info/en/new-spyware-cases-university-of-belgrade-and-prosecutors-office-targeted/","by":"SHARE Foundation","date":"2026-10-19"}],"started":"2026-09-02","closed":"2026-10-19","created":"2026-11-03T21:54:05.504Z","updated":"2026-11-03T21:54:05.504Z","cve_notes":[],"timeline":[{"at":"2026-10-19","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"SHARE said there had been no effective action on criminal complaints already filed over spyware. It warned that surveillance was extending to university and prosecution officials.","url":"https://sharefoundation.info/en/new-spyware-cases-university-of-belgrade-and-prosecutors-office-targeted/","by":"SHARE Foundation","patch":null},{"at":"2026-10-19","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"Citizen Lab confirmed a zero-click Pegasus infection of University of Belgrade rector Vladan Đokić’s iPhone in 2026, bringing its count to at least 16 people targeted or infected. Prosecutorial associate Rade Bajić had received Apple alerts on 13 and 27 August; analysis of his device remained ongoing.","url":"https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/","by":"Citizen Lab","patch":null},{"at":"2026-10-06","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"SHARE reported that student Jelena Kontić’s lawyers had filed a criminal complaint over Pegasus installation on her phone. It sought investigation of unidentified security-agency and police personnel and responsible individuals at NSO Group; these were allegations, not findings of guilt.","url":"https://sharefoundation.info/en/criminal-complaint-filed-over-spyware/","by":"SHARE Foundation","patch":null},{"at":"2026-09-03","added":"2026-11-03T21:45:10.669Z","kind":"other","text":"N1 reported that Serbia’s Security Intelligence Agency dismissed the surveillance allegations and said it operated within Serbian law. The agency did not provide a substantive explanation of the forensic findings.","url":"https://n1info.rs/english/news/bia-on-students-and-opposition-targeted-by-spyware-purely-trivial-sensationalism-we-respect-the-law/","by":"N1","patch":null},{"at":"2026-09-02","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"SHARE Foundation reported at least 14 people targeted: 12 Apple alert recipients, including the confirmed Pegasus case, and two separately confirmed NoviSpy-related infections. One Android phone had been confiscated during police questioning; installing the newly identified spyware required physical access.","url":"https://sharefoundation.info/en/share-foundation-students-and-opposition-politicians-targeted-by-spyware/","by":"SHARE Foundation","patch":null},{"at":"2026-09-02","added":"2026-11-03T21:45:10.669Z","kind":"disclosed","text":"Citizen Lab confirmed Pegasus infection of a Serbian student activist’s iPhone through iMessage without any action by the owner. Infection indicators spanned December 2025–January 2026; researchers believed Apple had blocked that exploit by iOS 18.4.1.","url":"https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/","by":"Citizen Lab","patch":"na"}],"url":"https://hard.fyi/live/serbia-pegasus-novispy-surveillance-sep-2026/","json":"https://hard.fyi/api/live?id=serbia-pegasus-novispy-surveillance-sep-2026"}