At least 14 people from different parts of Serbian civil society were targeted with advanced spyware in previous months. Share Foundation described this as the largest documented spyware infection campaign in the country’s history. The targets also included members of the student movement that has been holding protests against the Aleksandar Vucic government since 2024. The protests grew after an accident in November 2024 that killed 16 people, shortly after a Chinese-led consortium renovated the Novi Sad railway station.
The Citizen Lab investigated the attacks, which came to light after Apple sent threat notifications to people in 110 countries in August. According to Wednesday’s report, at least one activist was targeted with NSO Group’s Pegasus spyware; however, there is no evidence that the attack was carried out directly by the Vucic government. NoviSpy, which was used against students, had previously been linked to the government. Ana Brnabic denied the allegations. Share Foundation said the March elections could be a rehearsal and that the attacks could be repeated in October. Milica Popovic said the attacks would not stop the movement.
Why it matters
These findings show that the growing protests following the crash in Novi Sad that killed 16 people also face the risk of digital surveillance. The fact that members of the student movement were among the targets puts the spyware issue directly on the agenda for civil society and protesters in Serbia. The notifications Apple sent to people in 110 countries, meanwhile, show that the cases in Serbia have emerged as part of a broader threat landscape. However, the lack of evidence that the Pegasus attack was carried out by the Vucic government, along with the denial of the allegations, leaves responsibility as the key open question. While NoviSpy’s previous links to the government keep the debate alive, the Share Foundation’s assessment of the March elections and October also brings digital threats during election periods to the fore.
Background
Daha is not a new name in the FikirPilot archive: we have published 11 reports mentioning this name in the last 90 days; the most recent was dated 4 September 2026.