Loading story…
A report found that spyware targeted the phones of organizers of anti-government protests in central Belgrade, demonstrations that denounced corruption. The available reporting does not identify the specific malware, intrusion vector, perpetrators, number of victims, or the operational impact of the compromises.
Related reporting in Serbia alleged that students and opposition figures were monitored with Pegasus ahead of elections. US Congressman Joe Wilson separately accused President Aleksandar Vučić’s government of surveilling Serbian citizens; neither allegation is independently substantiated in the available material.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
In August 2026, 12 people contacted SHARE Foundation's digital-forensics team after receiving Apple Threat Notifications. Eleven of the 12 devices were presumed infected pending further forensic confirmation.
Serbian demonstrators held an anti-government protest in central Belgrade denouncing corruption.
SHARE Foundation identified a newly built Android spyware family resembling NoviSpy on two Serbian student-movement members' devices. One device was reportedly infected after confiscation during police questioning, while private Viber messages from the other device were later displayed on Informer TV.
Citizen Lab and the SHARE Foundation found high-confidence indicators that an iPhone used by a Serbian student protest-movement member was infected with NSO Group's Pegasus via an iMessage zero-click exploit. The indicators span December 2025 through January 2026; SHARE also reported at least 14 advanced-spyware targets in Serbia since the start of 2026.
Apple released iOS 18.4.1 in April 2025. Citizen Lab later assessed that this release had patched the iMessage zero-click exploit used in the Pegasus infection of a Serbian student activist.
Two journalists from the Balkan Investigative Reporting Network were targeted with NSO Group's Pegasus spyware in Serbia.
Twenty-nine Members of the European Parliament asked the EU to slow Serbia's accession process pending an investigation into alleged government spyware use. They cited findings involving Pegasus and NoviSpy targeting and urged that further accession progress be conditioned on rule-of-law accountability.
Serbia's BIA intelligence agency denied allegations that Serbian authorities targeted activists and opposition figures with Pegasus and NoviSpy, characterizing the claims as sensationalism motivated by foreign intelligence services and pressure groups.
SHARE Foundation reported that students and opposition politicians in Serbia were targeted by spyware, expanding the reported targets beyond student activists and protest organizers.
A report said spyware targeted the phones of Serbian protest organizers. The available information did not identify the spyware, its operator, the responsible party, affected individuals, intrusion method, or scope of impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
16 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcereddit.com
Open sourceinfosec.pub
Open sourcecyberveille.ch
Open sourcecitizenlab.ca
Open sourcebloomberg.com
Open sourcesharefoundation.info
Open sourcesupport.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belarusian authorities have been found to deploy a previously unknown spyware, dubbed **ResidentBat**, on the smartphones of local journalists during police interrogations. The spyware was discovered after a journalist, interrogated by the Belarusian KGB, received malware alerts on their device. Investigations by Reporters Without Borders (RSF) and RESIDENT.NGO revealed that the spyware can access call logs, SMS and encrypted app messages, record audio, capture screens, and exfiltrate local files. The infection process reportedly involved authorities observing the journalist unlock their phone, then installing the spyware while the device was out of the journalist's possession. ResidentBat's server infrastructure has been active since at least March 2021, coinciding with anti-government protests in Belarus. The use of ResidentBat highlights a broader trend of authoritarian regimes leveraging spyware to target journalists and suppress independent reporting. Similar tactics have been observed in countries such as Serbia and Kenya, where authorities install surveillance tools on detainees' devices during questioning. The discovery of ResidentBat underscores the ongoing risks faced by journalists in Belarus, where state surveillance is used as a tool of repression. Google has been notified and is expected to alert other users potentially affected by this spyware.
Jun 29, 2026
Cellebrite said it has suspended the use of some of its digital forensic products by certain customers in Serbia after Amnesty International reported that Serbian police and intelligence services allegedly used the technology to unlawfully extract data from the phones of activists and journalists. Amnesty said its December 2024 investigation found that authorities used mobile device extraction tools outside legally sanctioned procedures and, in some cases, that targeted phones were later infected with spyware. The dispute has intensified scrutiny of Serbia’s treatment of civil society and independent media, with Amnesty arguing that the surveillance activity occurred amid anti-government protests and a broader pattern of pressure on government critics. Amnesty welcomed Cellebrite’s move but called on the company to strengthen human-rights due diligence and urged a halt to exports of surveillance and digital forensics technology to Serbia until effective independent oversight is in place.
Jul 24, 2026
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Aug 14, 2026