Serbians targeted with spyware in country’s ‘largest documented wave of surveillance’

The wave of spyware infections was discovered in August after Apple notified people in 110 ⁠countries that they had probably been victims ⁠of mercenary spyware. The Citizen Lab, which carries out forensic analyses of spyware attacks, released an analysis on Wednesday showing that at least one of the Serbians had been targeted with the NSO Group’s Pegasus spyware, which would have given the attacker “total access to the device”. Share said those targeted included members of a Serbian student movement that has been a thorn in the side of the government of Aleksandar Vučić since 2024.

Coalescing out of countrywide protests that followed the collapse of a train station that winter, it is one of the largest student movements in Europe. Vučić has been in power for more than a decade, during which time critics have said he has overseen a hollowing-out of institutions while steering the country closer to Moscow. There is no evidence that Vučić’s government was the entity that targeted the student with the Pegasus spyware.

However, other spyware used against the students, including a software called NoviSpy, has been previously connected to Serbian authorities. In an interview with Euronews Serbia TV on Wednesday, Ana Brnabić, the parliamentary speaker and a ranking member of the ruling Serbian Progressive party, denied that students had been spied on. She said: “Thinking that someone may have entered my private space without my knowledge made me feel so exposed.” But, she said, the attack, as uncomfortable as it was, would not deter her or the student movement.

It is now under US ownership, and appears to be searching for a way into the US market, including through efforts to get off the US Commerce Department’s blacklist. However, this and other incidents will raise questions about what has been described as their attempt to rebrand as an “ethical spyware company”. NSO Group has been permanently barred by a US court from targeting WhatsApp users and Meta products.

It is unclear if this most recent Pegasus attack happened via WhatsApp. NSO spent a decade promising reform, yet their spyware is still an instrument of political repression,” said Railton.