Researchers confirm Pegasus and a new NoviSpy variant hit at least 14 Serbian activists and students since January.