Researchers have documented the first confirmed Pegasus spyware infection of 2026, plus a newly built NoviSpy variant, in what they describe as the largest surveillance wave yet seen in Serbia. At least 14 people have been targeted since the start of the year, among them student protesters, activists, an opposition member of parliament, and a local councilor.
Citizen Lab and the SHARE Foundation said the iPhone of a student movement member was infected through an iMessage zero-click exploit between December 2025 and January 2026. Apple addressed that exploit in iOS 18.4.1, and the infections surfaced after Apple sent fresh threat notifications to suspected mercenary spyware targets in 110 countries.
Amnesty International’s Security Lab said another student’s phone was loaded with Android spyware similar to NoviSpy while the device sat confiscated during police questioning. The same strain later appeared on a second phone whose private messages aired on a pro-government television channel. Amnesty and SHARE both assess that Serbian authorities carried out the variant infections.
The timeline overlaps Serbia’s March 29 local elections and protests tied to the 2024 Novi Sad railway station disaster. Citizen Lab researchers note the case echoes the first Pegasus discovery against a pro-democracy activist a decade ago. At-risk users should keep devices updated and consider iOS Lockdown Mode or Google’s Advanced Protection Program.
