Pegasus and New NoviSpy Variant Found on Serbian Activists’ Devices
Summary
Researchers reported Pegasus and NoviSpy infections targeting Serbian activists and officials. SHARE Foundation identified 14 targets; Citizen Lab assessed one Pegasus infection as highly probable, and Amnesty confirmed NoviSpy on two devices.
Key points
- SHARE Foundation said 14 people were targeted, including a member of parliament and a local government official.
- Citizen Lab assessed a student activist’s Pegasus infection as highly probable; the reported infection used a zero-click exploit from December to January.
- Amnesty International confirmed a new NoviSpy variant on two devices. One infection followed police questioning and the seizure of a student’s phone.
- SHARE Foundation and Amnesty said evidence points to Serbian police or secret services in the NoviSpy cases; this attribution is not presented as confirmed.
- The researchers linked the targeting to student protests and election tensions, and SHARE Foundation described it as the largest documented wave of this surveillance in Serbia.
- Researchers said Apple threat notifications helped expose the infections. A Citizen Lab researcher said Apple updates had broken the particular exploit and urged users to update iOS.
Article Details
- Incident Type
- Spyware surveillance targeting Serbian activists and public officials; reported infections involved Pegasus and a new NoviSpy variant.
- Data Types Exposed
- Private messages
- Affected Records
- The SHARE Foundation reported 14 people targeted. Amnesty International confirmed NoviSpy on two devices; Citizen Lab assessed the Pegasus infection of one student activist as highly probable.
- Operational Impact
- Spyware infections were reported on targeted devices. The article describes spyware's general capabilities but does not specify further operational impact in these cases.
- Claim Status
- confirmed
People
Bill MarczakSenior researcher at Citizen Lab who said Apple updates had broken the exploit and urged users to update iOS.Donncha Ó CearbhaillHead of Amnesty International’s Security Lab; commented on forensic findings and the suspected circumstances of the NoviSpy infections.John Scott-RailtonSenior researcher who commented on the Pegasus infection and its use against people campaigning for democracy.
Malware
NoviSpyResearchers uncovered the first confirmed Pegasus spyware infection of 2026 and a new NoviSpy variant targeting Serbian student activists, lawmakers, and local officials.PegasusResearchers uncovered the first confirmed Pegasus spyware infection of 2026 and a new NoviSpy variant targeting Serbian student activists, lawmakers, and local officials.
Vendors
AppleThe cases, linked to political unrest and upcoming elections, suggest a broader surveillance campaign in Serbia, with Apple notifications helping expose the victims.NSO GroupIn the case of the infection from NSO Group’s Pegasus spyware, it’s rare for investigators to determine who specifically made use of it, although they found that the student’s device was hacked with a Pegasus zero-click