Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.

Vladan Ðokić, the rector of the University of Belgrade and prominent figure in the country’s student protest moment, and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime, were targeted, according to research from the SHARE Foundation, a Serbian digital rights group, and The Citizen Lab at the University of Toronto.

The new cases follow what the SHARE Foundation described in September as the largest documented wave of spyware surveillance in the country to date. That wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.

Đokić, an architect and former dean of the university’s Faculty of Architecture, has led the University of Belgrade since 2021. He has publicly backed the student-led anti-corruption protests that followed the 2024 Novi Sad railway station canopy collapse, and government officials and pro-government news outlets have portrayed him as a driving force behind the movement.

His tenure has included direct confrontations with the government. In March, Serbian authorities raided his offices, and reportedly seized computers and servers. After the incident, Đokić accused authorities of trying to humiliate the institution, saying police entered without prior notice or clear legal grounds.

Andrijana Ristić, a researcher at the SHARE Foundation, whose organization conducted the initial forensic analysis, said the case is the second confirmed Pegasus infection in Serbia this year. She declined to say when the infection was discovered, citing the sensitive nature of the investigation.

The device was then given to The Citizen Lab to further confirm that Pegasus was used.

“We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026,” a report released by the lab reads. “The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection.”

Ðokić was unavailable for comment. 

Bajić was on the legal team prosecuting a high-profile corruption case involving Serbian government officials signing off on a $500 million hotel and residential tower planned for a protected historic site in Belgrade. According to recent reporting from The Guardian, Serbian President Aleksandar Vučić allegedly pressed government officials to strip the building’s protection so that Affinity Partners, the private investment firm owned by Jared Kushner, could develop it into a Trump hotel. 

Bajić believes his work on the case led to him being a target of spyware. He pointed CyberScoop to news articles and Serbian television programs where Vučić referred to him as a “criminal” and part of a “gang that fabricated” the corruption case. 

“In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić told CyberScoop.

Ristić told CyberScoop that Bajić received a threat notification from Apple, but neither SHARE nor Citizen Lab could pinpoint exactly what type of spyware his device was infected with. The investigation of Bajić’s device is ongoing.

Ristić described surveillance in Serbia as longstanding, tracing it to earlier tools such as FinFisher and alleged dealings with the hacking group Hacking Team — along with the original NoviSpy report by Amnesty International in 2024, which identified journalists, activists and civil society members as targets.

“I would definitely say that [spyware] is widespread,” she told CyberScoop. “I think right now it’s gaining much more media attention, especially internationally, because of the political moment.”

John Scott-Railton, senior researcher at The Citizen Lab, said “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression. So it’s no accident that people standing up for freedom in the face of corruption keep getting hacked with NSO’s products.”

Serbia will hold parliamentary elections Oct. 25, with Vučić fighting to retain control of the government. The vote comes amid the student-led protest movement, fueled by anger over government corruption, that has grown into the largest challenge to Vučić’s rule in years.

The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared first on CyberScoop.

A group of European Parliament representatives are seeking to delay Serbia’s entry into the European Union and send other messages to Belgrade over the government’s usage of spyware.

The 29 members of the European Parliament (MEPs) cited a report this week from the SHARE Foundation about spyware found on the phones of Serbian student activists and that targeted others as well. The foundation, along with Amnesty International and The Citizen Lab at the University of Toronto, discovered both Pegasus and NoviSpy spyware infections.

The groups didn’t assign responsibility for the Pegasus infection, but said evidence from the NoviSpy infections pointed to Serbian government authorities.

“This is not a technical glitch; it is a direct state attack on democracy,” the 29 MEPs wrote Friday. “With upcoming elections ahead, Aleksandar Vučić’s regime is using illegal digital surveillance to systematically dismantle political opposition.”

The MEPs’ demands include slowing Serbian accession into the EU until completing an investigation into Serbia’s spyware usage and making Serbia’s accession contingent on improving rule-of-law accountability.

They also said President Ursula von der Leyen should cancel a planned visit to Serbia. European leaders were already outraged by the response from Serbia to the death of former Bosnian Serb army commander and war criminal Ratko Mladic, with Enlargement Commissioner Marta Kos canceling her own visit Friday over the alleged “glorification” of Mladic.

The spyware letter adds to the pressure, said Hannah Neumann, an MEP who signed it.

“It could very well be that some of these demands will be honored, but for sure the spyware won’t be the only reason why,” she told CyberScoop. Serbia’s history of spyware use contributed to Friday’s letter, she said: “We have been critical towards the government for already quite some time and demanded consequences so this was another straw.”

The Serbian government did not respond to multiple requests late Friday for comment.

“Appeasement has failed,” the members wrote. “It is time for the Commission to demonstrate that compliance with fundamental democratic standards is a non-negotiable requirement, not an option.”

European Union member nations have faced their own allegations over using spyware, and recent revelations of spyware found on the device of a member of the European Parliament’s PEGA Committee has prompted some to renew calls for enactment of recommendations from that committee to address spyware abuses.

The post European parliament members call for slowdown of Serbia’s EU entry over spyware use appeared first on CyberScoop.

Researchers say they have uncovered the first confirmed Pegasus spyware infection of 2026, as well as another spyware variant infection, targeting Serbian student activists and others in what one group called the largest documented wave of that kind of surveillance in the country to date.

The SHARE Foundation said Wednesday that it found 14 people targeted in all, including one member of parliament and a local government official. The University of Toronto’s Citizen Lab confirmed the Pegasus infection of a student activist with “high probability,” while Amnesty International confirmed that two devices had been infected with a new version of the NoviSpy spyware.

The SHARE Foundation noted that the infections coincided with the build-up to key local elections in March that were viewed as a test of the ruling Serbian Progressive Party, with student protests rising in the wake of the 2024 Novi Sad railway station canopy collapse, and in advance of October parliamentary elections.

Serbian activists have found themselves targeted with spyware numerous times before, including by Pegasus and NoviSpy. But the SHARE Foundation said this was the biggest wave there so far.

Spyware is noted for its ability to access everything on a device, record screens or take over its microphone.

NoviSpy variant infections

One NoviSpy variant infection came after authorities took a student’s phone during police questioning, and the same spyware was found on another device as well after private messages from the phone were disclosed by a media outlet that favors the ruling party, SHARE Foundation said.

The SHARE Foundation said signs point to Serbian police or secret service being behind the NoviSpy variant cases, with Amnesty International offering a similar assessment. 

“These new forensic findings show that Serbian student activists continue to be targeted with invasive spyware,” Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, told CyberScoop. “As with NoviSpy, which Amnesty International found used extensively in Serbia in 2024, the evidence suggests the infections are being carried out during detention by the Serbian authorities.”

Pegasus infection

In the case of the infection from NSO Group’s Pegasus spyware, it’s rare for investigators to determine who specifically made use of it, although they found that the student’s device was hacked with a Pegasus zero-click exploit from December of last year to January of this year. The infection came via a zero-click exploit — meaning without victim interaction.

But Citizen Lab said the Serbian case harkens back to the first discovery of Pegasus a decade ago when it was against a pro-democracy activist, Ahmed Mansoor.

“Today, Pegasus is still being used to hack people campaigning for democracy,” said John Scott-Railton, senior researcher. “NSO spent a decade promising reform, yet their spyware is still an instrument of political repression.”

NSO Group maintains that its spyware is for usage against terrorism and crime, and that it halts any abuses it discovers.

The spyware discoveries in Serbia came after Apple sent threat notifications to the targets.

“Apple’s updates have broken this particular exploit, so we urge everyone to make sure they are updated to the latest version of iOS,” said Bill Marczak, senior researcher at Citizen Lab.

The post Pegasus, NoviSpy variant spyware found on devices of Serbian activists appeared first on CyberScoop.