Serbia Targets 14 Opposition Figures With Pegasus and NoviSpy Spyware Around March Local Elections

At least 14 Serbians—including a Parliament member, opposition politicians, and student protesters—were targeted with Pegasus and NoviSpy spyware between December 2025 and August 2026, according to forensic analysis by the SHARE Foundation and Amnesty International. The targeting coincided with March local elections and student-led anti-government protests, with victims' communications subsequently broadcast on state-aligned media.

The targeting of student election organizers in March, followed by live broadcast of intercepted messages on state media in August, is not surveillance for counterintelligence—it is political theater designed to intimidate. Serbia's BIA denial invoking 'foreign pressure groups' mirrors Russian and Chinese playbooks for dismissing digital-rights documentation, which suggests either direct coordination or convergent doctrine. The October parliamentary elections are now a decision point: if the government escalates spyware targeting or arrests based on intercepts, NATO and the EU face a choice between treating Serbia as a democratic backslider requiring sanctions or tolerating it as a strategic hedge against Russian influence—a choice that will surface in Brussels by November.

WHY IT MATTERS

Serbia's government is using industrial-grade surveillance to suppress domestic opposition ahead of October parliamentary elections, and the targeting pattern—spiking around electoral moments—signals a systematic compression of political space that will intensify as voting approaches.

The SHARE Foundation and Amnesty confirmed Pegasus infections on at least one student protester between December 2025 and January 2026, and a new NoviSpy variant on at least two additional targets; Amnesty's Security Lab head explicitly flagged October elections as a heightened risk window for further repression. The government's denial—framing the forensic findings as 'foreign intelligence' cover—is the classic playbook of states deploying spyware against domestic dissidents, and it leaves no enforcement mechanism short of EU sanctions or NATO member pressure.

WHAT THIS DOESN’T TELL US

Have EU or US intelligence services independently confirmed Serbian government use of Pegasus or NoviSpy, or is this assessment based solely on Citizen Lab and Amnesty forensics? Does the October election timeline match a planned government crackdown, or is Amnesty's warning speculative?

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →