Serbian watchdog uncovers Pegasus and NoviSpy spying on 14 activists in 2026

Serbian digital‑rights watchdog SHARE Foundation announced on Monday that it has identified at least 14 students and opposition activists who were targeted with either the Israeli‑developed Pegasus spyware or the newer Serbian‑origin NoviSpy platform during 2026. The organization supplied technical evidence to the University of Toronto’s Citizen Lab, which independently verified a Pegasus infection in one of the cases. The findings mark the first publicly documented use of NoviSpy, a tool that emerged from a domestic tech firm in Belgrade and is marketed as a “law‑enforcement” solution, and they raise fresh concerns about state‑linked surveillance of dissent in the Balkans.

Serbia’s political environment has grown increasingly fraught since the 2020 parliamentary elections, when the ruling Serbian Progressive Party (SNS) consolidated power and faced mounting criticism from civil‑society groups over media freedom and judicial independence. Opposition parties and student movements have been vocal about alleged electoral irregularities and the government’s handling of protests against the proposed “Law on Public Gatherings.” In this context, digital surveillance has become a strategic instrument for monitoring and potentially intimidating critics. Pegasus, sold by the Israeli firm NSO Group, has been linked to a string of high‑profile abuses across the globe, prompting numerous investigations and legal actions. NoviSpy, by contrast, is a newer entrant that claims compliance with European data‑protection standards, yet its code shares similarities with known NSO modules, suggesting possible technology transfer or licensing arrangements.

The technical analysis performed by SHARE and corroborated by Citizen Lab shows that the spyware was installed via spear‑phishing messages that appeared to come from familiar contacts, a method consistent with previous Pegasus campaigns. Once active, the software can exfiltrate contacts, messages, location data and microphone feeds, effectively turning a smartphone into a real‑time surveillance device. While the confirmed Pegasus infection involved a university student who had participated in anti‑government demonstrations, the alleged NoviSpy cases include members of a student environmental group and a journalist covering the opposition’s legal challenges. Both tools enable operators to bypass standard security safeguards, raising the stakes for individuals whose online activities are already under scrutiny.

Serbian authorities have so far declined to comment on the allegations, and the Ministry of Interior has previously defended the procurement of surveillance technologies as necessary for “national security and public order.” Human‑rights organisations, however, argue that such a rationale is increasingly being used to justify the targeting of political opponents, undermining the constitutional guarantees of privacy and freedom of expression. The European Union, which has urged Serbia to align its digital‑rights framework with EU standards as part of the accession dialogue, may view the revelations as a test of Belgrade’s commitment to democratic norms. Meanwhile, the exposure of NoviSpy could prompt other governments to reassess the provenance and oversight of domestically produced surveillance tools, especially as the market for such software expands beyond traditional exporters like Israel and the United States.

The episode underscores broader implications for the region’s digital‑rights landscape and for countries such as Taiwan that are navigating similar tensions between security imperatives and civil liberties. Taiwan’s own experience with sophisticated spyware—most notably the 2021 indictment of NSO Group for alleged attacks on Taiwanese officials—highlights the transnational nature of these threats. As both Serbia and Taiwan grapple with the challenge of protecting democratic discourse while defending against cyber‑espionage, the SHARE findings reinforce the need for robust legal safeguards, transparent procurement processes and international cooperation on spyware regulation. Strengthening digital‑rights protections not only shields activists and journalists but also contributes to the resilience of the broader information ecosystem that underpins regional stability and economic confidence.