Pegasus and NoviSpy infections target Serbia’s pro-democracy movement
Pegasus and NoviSpy-related spyware compromised Serbian activists’ phones. Later findings extended to a university rector. Update devices, enable iPhone Lockdown Mode if at risk, and get expert help immediately after a spyware alert.
Keep phones updated; if you face targeted surveillance, enable iPhone Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then restart as prompted. Verify any Apple threat alert by signing in directly at account.apple.com and immediately contact SHARE Foundation in Serbia or Access Now’s Digital Security Helpline. Ask those experts about screening close family members and collaborators too.
What’s happening
Investigations published on 2 September confirmed spyware attacks against Serbia’s pro-democracy movement. Citizen Lab found Pegasus on a student activist’s iPhone, with infection indicators spanning December 2025–January 2026. The iMessage attack required no interaction and could expose messages, photos and other private data, alongside microphone and camera access. SHARE Foundation separately confirmed two NoviSpy-related infections and documented at least 14 people targeted, including students, activists and opposition politicians. Apple alerts indicated targeting, not forensic confirmation of every infection. Citizen Lab believed the student’s exploit had been blocked by iOS 18.4.1; this was not an all-clear for the wider campaign or infected devices. On 6 October, SHARE reported a criminal complaint over student Jelena Kontić’s Pegasus infection. On 19 October, Citizen Lab confirmed rector Vladan Đokić’s infection, bringing its count to at least 16 people targeted or infected. Analysis of prosecutorial associate Rade Bajić’s device continued. SHARE reported no effective action on existing complaints; the reviewed sources provide no subsequent resolution through 3 November.
- What
- Breach
- Affects
- Apple iPhone and Android phones targeted with Pegasus and NoviSpy-related spyware
- Fixed in
- Nothing to patch
- Since
- 2 Sept 2026
- Closed
- 19 Oct 2026
Timeline
- Update
SHARE said there had been no effective action on criminal complaints already filed over spyware. It warned that surveillance was extending to university and prosecution officials.
- Update
Citizen Lab confirmed a zero-click Pegasus infection of University of Belgrade rector Vladan Đokić’s iPhone in 2026, bringing its count to at least 16 people targeted or infected. Prosecutorial associate Rade Bajić had received Apple alerts on 13 and 27 August; analysis of his device remained ongoing.
- Update
SHARE reported that student Jelena Kontić’s lawyers had filed a criminal complaint over Pegasus installation on her phone. It sought investigation of unidentified security-agency and police personnel and responsible individuals at NSO Group; these were allegations, not findings of guilt.
- Update
N1 reported that Serbia’s Security Intelligence Agency dismissed the surveillance allegations and said it operated within Serbian law. The agency did not provide a substantive explanation of the forensic findings.
- Made public
SHARE Foundation reported at least 14 people targeted: 12 Apple alert recipients, including the confirmed Pegasus case, and two separately confirmed NoviSpy-related infections. One Android phone had been confiscated during police questioning; installing the newly identified spyware required physical access.
- Made publicNothing to patch
Citizen Lab confirmed Pegasus infection of a Serbian student activist’s iPhone through iMessage without any action by the owner. Infection indicators spanned December 2025–January 2026; researchers believed Apple had blocked that exploit by iOS 18.4.1.
Sources
- About Apple threat notifications and protecting against mercenary spywareApple · 13 Aug 2026
- About Lockdown ModeApple · 18 Sept 2026
- Pegasus Spyware Infection of Serbian Pro-Democracy Student ActivistCitizen Lab · 2 Sept 2026
- SHARE Foundation: Students and Opposition Politicians Targeted by SpywareSHARE Foundation · 2 Sept 2026
- BIA on students and opposition targeted by spyware: “Purely trivial sensationalism, we respect the law”N1 · 3 Sept 2026
- Criminal Complaint Filed Over SpywareSHARE Foundation · 6 Oct 2026
- Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy FiguresCitizen Lab · 19 Oct 2026
- New Spyware Cases: University of Belgrade and Prosecutor’s Office TargetedSHARE Foundation · 19 Oct 2026