Serbian Activists and MP Found Infected with NSO Group Spyware Ahead of Elections

BELGRADE (Sept. 2, 2026) — Serbian authorities are under scrutiny after researchers confirmed that devices belonging to democracy campaigners, including a member of parliament and a student activist, were infected with Pegasus spyware and a variant known as NoviSpy. The infections were detected on Tuesday, raising concerns about state-sponsored surveillance targeting political opponents in the months leading up to critical local elections scheduled for March and October.

The discovery follows a period of heightened civil unrest triggered by student protests over a catastrophic railway station collapse earlier this year. Researchers identified the sophisticated malware, developed by the Israeli firm NSO Group, on mobile devices used to coordinate opposition activities. The software is capable of extracting messages, emails, photos, and location data without the user's knowledge.

The targeted individuals include a sitting member of parliament who has been vocal about government accountability and a student leader at the forefront of demonstrations demanding infrastructure reforms. Security experts noted that the use of NoviSpy, a less common variant, suggests an attempt to evade standard detection methods typically employed by digital rights organizations.

Serbian officials have not publicly commented on the specific infections or acknowledged the involvement of NSO Group technology. Government spokespeople have previously stated that all surveillance activities are conducted strictly in accordance with national security laws and only against verified threats to public safety. However, the timing of the infections coincides with a surge in political mobilization aimed at challenging the ruling party's hold on power.

The railway station collapse, which killed dozens and injured hundreds, sparked weeks of protests that evolved into broader calls for democratic reforms. Opposition leaders have argued that the government is using advanced surveillance tools to intimidate dissenters and monitor protest strategies ahead of the upcoming municipal votes. They contend that the targeting of a parliamentarian indicates an escalation in efforts to suppress political opposition.

NSO Group has historically sold its spyware only to government clients for combating terrorism and serious crime, though it has faced international criticism for alleged human rights abuses linked to its technology. The company has not issued a statement regarding the specific cases in Serbia.

Digital rights advocates are calling for an independent investigation into how the spyware was deployed and who authorized its use. Questions remain regarding whether other journalists, lawyers, or opposition figures have been similarly targeted. As the election cycle intensifies, the incident has added a layer of uncertainty to the political landscape, with critics warning that unchecked surveillance could undermine the integrity of the democratic process.

The situation remains fluid as researchers continue to analyze the scope of the infections and determine if additional devices are compromised. Serbian authorities have yet to address whether domestic agencies or foreign actors facilitated the deployment of the spyware.