Someone Is Secretly Spying on Serbia's Activists and Politicians. Here's the Story.

At least 14 people from Serbian civil society were targeted with advanced spyware since the beginning of 2026, according to findings published by the digital rights group Share Foundation on September 2, 2026 Share Foundation. The infections were discovered in August 2026 after Apple sent warnings to people in 110 countries telling them they had likely been targeted by spyware attacks Apple Support.

Spyware is a type of software that secretly takes over a phone or computer. Once installed, it can read messages, listen to calls, track location, and look at photos — all without the owner knowing. The kind used here is called "mercenary spyware," meaning it is built by private companies and sold to clients, often governments, for the purpose of spying on specific people.

This is the largest documented spyware attack of its kind in Serbia to date, according to Share Foundation. The people targeted included members of a Serbian student movement that has opposed the government of President Aleksandar Vučić since 2024, along with activists, a member of parliament, and a local councilor from opposition parties Share Foundation. The student movement began after nationwide protests triggered by the collapse of a train station in winter 2024. Reuters reported that the spying happened ahead of local elections held in March Reuters.

A technical report from the Citizen Lab, released September 2, 2026, confirmed that at least one person in Serbia had been targeted with a spyware tool called Pegasus, made by a company called NSO Group. Pegasus gives the person who deploys it full access to the victim's phone. NSO Group started as an Israeli company with ties to the military and is now owned by a US-based entity The Guardian.

Ana Brnabić, Serbia's parliamentary speaker and a senior member of the ruling Serbian Progressive Party, denied that students had been spied on. There is no evidence directly linking the spying to the government of Aleksandar Vučić The Guardian. That gap matters. Pegasus is only sold to governments, but the spyware market is deliberately hard to trace. It is difficult to figure out who actually operated the tool — the company that made it, the government that bought it, or someone else entirely. This uncertainty helps whoever is responsible.

Share Foundation pointed out that the spyware was used around March's local elections and may have been a test run ahead of snap national elections scheduled for October 2026. The back-to-back elections make the timing important. Spying during election season can help map out who the opposition is talking to, what they are planning, and how they organize. Moving from local to national elections raises the stakes for the people who were already being watched.

The fact that a member of parliament and a local councilor were targeted alongside student organizers shows the spying went beyond grassroots activists and into formal political opposition. This could mean the goal was to gather information across different levels of the opposition at the same time.

Share Foundation has helped people understand and protect against these risks before. In September 2025, they published "Citizens' Nightmare: A Manual for Understanding Spyware," a guide explaining how these tools work Share Foundation. The new findings confirm what the group had warned about, moving from a general warning to a real, documented case.

Three sources together build the case: Apple's system detected the attacks, Citizen Lab confirmed the specific spyware used, and Share Foundation identified who was targeted and why it matters politically. The denial from parliamentary speaker Ana Brnabić sits against this technical evidence, creating a familiar tension between what investigations find and what politicians say.

The bigger picture is that companies selling spyware make it possible for governments to surveil people without leaving clear fingerprints. The use of Pegasus against Serbian civil society ahead of elections fits a pattern where surveillance and democratic processes overlap. The October 2026 snap elections will be a key moment to watch — whether the strategy seen in March extends into the national campaign.

What is known: who was targeted, how it was done, and what the tools can do. What is not known: who operated the spyware. Serbia's political landscape — a long-entrenched ruling party and an opposition born from street protests — sets the scene. The spyware is the tool. The space between the two is where accountability would normally be found, and that is exactly the space the current evidence cannot fill.