At Least 14 People in Serbia Targeted With Pegasus and NoviSpy Spyware
Summary
Researchers say at least 14 people in Serbia were targeted with spyware. Citizen Lab confirmed one Pegasus infection, while Amnesty International identified NoviSpy in at least two cases; Serbian authorities denied the accusations.
Key points
- The SHARE Foundation reported that at least 14 people, including a parliamentarian, an opposition politician, and student protesters, were targeted since December.
- Citizen Lab confirmed a zero-click Pegasus infection on a student protester’s phone between December 2025 and January 2026.
- Amnesty International confirmed NoviSpy use in at least two cases; forensic research on 11 additional phones is ongoing.
- Researchers said the targeting coincided with March local elections and protest organizing.
- The SHARE Foundation said one confirmed NoviSpy victim’s text messages were read on a Serbian television network friendly with the ruling party.
- Serbian authorities denied the accusations, and the intelligence agency BIA called them sensationalism.
Article Details
- Incident Type
- Targeting and confirmed infections of individuals' phones with Pegasus and NoviSpy spyware
- Data Types Exposed
- Text messages
- Affected Records
- At least 14 people were reportedly targeted; one Pegasus infection and at least two NoviSpy cases were confirmed. Forensic research on 11 additional phones was ongoing.
- Operational Impact
- Spyware targeting affected a parliamentarian, an opposition politician, and student protesters. In one confirmed NoviSpy case, the victim's text messages were reportedly read live on a Serbian television network. Forensic research was ongoing to determine whether other targeting resulted in successful infections.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
People
Donncha Ó CearbhaillHead of Amnesty International’s Security Lab; commented on the NoviSpy variant.John Scott-RailtonCitizen Lab researcher involved in confirming the Pegasus infection.Ognjen RašićStudent protester whose phone was still under forensic study; he believed he was likely targeted with Pegasus, but infection was not confirmed.Radomir LazovićSerbian parliamentarian who said his phone was among the 14 targeted; forensic research to determine whether the attack succeeded was ongoing.
Malware
NoviSpyspyware, with Citizen Lab confirming one Pegasus infection and Amnesty International identifying NoviSpy in at least two cases.Pegasuspolitician, and student protesters, were targeted with advanced spyware, with Citizen Lab confirming one Pegasus infection and Amnesty International identifying NoviSpy in at least two cases.
Vendors
CellebriteA month earlier, Amnesty reported that Cellebrite, whose software allows governments to break into and extract data from phones, cut ties with Serbia after an Amnesty report documenting the use of NoviSpy to targetNSO Groupa Citizen Lab researcher involved in the Pegasus confirmation, said the spyware’s manufacturer, NSO Group, continues to enable authoritarian governments even as Apple threat notifications and sophisticated
Products
CellebriteA month earlier, Amnesty reported that Cellebrite, whose software allows governments to break into and extract data from phones, cut ties with Serbia after an Amnesty report documenting the use of NoviSpy to targetNoviSpyspyware, with Citizen Lab confirming one Pegasus infection and Amnesty International identifying NoviSpy in at least two cases.Pegasuspolitician, and student protesters, were targeted with advanced spyware, with Citizen Lab confirming one Pegasus infection and Amnesty International identifying NoviSpy in at least two cases.