NSO Group—NSO Pegasus spyware found on devices of Serbian pro-democracy activists, an MP, and a local official ahead of 2026 elections
Digital rights group SHARE Foundation, corroborated by Amnesty International and Citizen Lab, found at least 14 Serbians infected with mercenary spyware between December 2025 and August 2026, including student pro-democracy activists, an opposition member of parliament, and a local government official. At least one confirmed Pegasus infection (zero-click) was documented alongside at least two infections with a domestic NoviSpy spyware variant, one occurring after police confiscated a student's phone during questioning. Apple sent threat notifications to affected users in 110 countries on August 13, 2026. The targeting coincided with Serbia's March 2026 local elections and ongoing student protests following the 2024 Novi Sad railway station collapse, with additional targeting anticipated around October 2026 parliamentary elections. Citizen Lab researcher John Scott-Railton said Pegasus 'is still being used to hack people campaigning for democracy' despite a decade of NSO reform promises.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Authoritarian Compliance | +toward | primary | -1.00 |
| Democratic Institutions | -against | secondary | -0.50 |
| Digital Safety for Vulnerable Users | -against | secondary | -0.50 |
| Surveillance Technology | +toward | primary | -1.00 |
| Overall incident score = | -0.643 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.57)
Evidence (1 signal)
SHARE Foundation and Citizen Lab report Pegasus and NoviSpy spyware found on Serbian activists' and MP's devices
Digital rights group SHARE Foundation, with Amnesty International and Citizen Lab, documented at least 14 Serbians infected with Pegasus and the domestic NoviSpy spyware variant between December 2025 and August 2026, including student activists, an opposition MP, and a local official.