Serbian BIA Runs Pegasus and NoviSpy on Opposition During 2025-2026 Election Window
Serbia's intelligence service combined NSO Pegasus with a locally adapted NoviSpy variant to suppress election-related organizing. Forensic timelines contradict official denials and align with documented prior targeting of journalists. The pattern indicates sustained domestic surveillance ahead of the October parliamentary vote.
SHARE Foundation traced Apple threat notifications to 12 victims; Citizen Lab verified Pegasus on one student protester device while Amnesty Security Lab peer-reviewed NoviSpy on two others. One NoviSpy victim's live SMS traffic appeared on a ruling-party television channel. Cellebrite extractions during prior detentions supplied the physical access vector for NoviSpy.
Citizen Lab: At least five additional Pegasus or NoviSpy infections confirmed in Serbia by 31 October 2026.
Sources (3)
- [1]Primary Source(https://therecord.media/serbia-spyware-pegasus-europe)
- [2]Supporting Source(https://www.amnesty.org/en/latest/research/2025/03/serbia-pegasus-journalists)
- [3]Supporting Source(https://citizenlab.ca/2026/02/serbia-pegasus-student-protester)