Apple threat notifications led one of twelve Serbians to a forensics lab that confirmed Pegasus infection

Citizen Lab confirmed one of the student protesters' phones was infected with zero-click Pegasus spyware between December 2025 and January 2026.

Citizen Lab confirmed the Pegasus infection of a student activist with 'high probability', and researchers say it is the first confirmed Pegasus infection of 2026.

Forensic research is ongoing for 11 additional phones whose owners were alerted by Apple to likely malicious activity.

Amnesty International, which peer reviewed SHARE Foundation's findings, confirmed that a new form of Android spyware known as NoviSpy was used in at least two cases.

One of the confirmed NoviSpy victims' text messages were read live on a Serbian television network friendly with the ruling party, SHARE Foundation said.

One NoviSpy variant infection came after authorities took a student's phone during police questioning.

In February 2025 Amnesty reported that Cellebrite cut ties with Serbia after an Amnesty report documented the use of NoviSpy against dissidents and journalists whose phones were taken in government custody; police never asked detainees for passwords and instead broke into the phones using Cellebrite, then implanted the spyware.

In March 2025, Amnesty International said its forensic researchers had found two investigative journalists in Serbia were targeted with Pegasus.

The timing of the spyware targeting and infections coincided with local elections held in March, and the student protesters were active in election organizing in an effort to oust the ruling party.

SHARE Foundation noted the infections coincided with the build-up to March local elections viewed as a test of the ruling Serbian Progressive Party, with student protests rising in the wake of the 2024 Novi Sad railway station canopy collapse, and in advance of October parliamentary elections.

O Cearbhaill said the attacks tend to spike around heightened political moments and that Amnesty is increasingly concerned about the safety of student protesters and civil society in the lead-up to early parliamentary elections likely to take place in October.

'Apple's updates have broken this particular exploit, so we urge everyone to make sure they are updated to the latest version of iOS,' said Bill Marczak, senior researcher at Citizen Lab.

The new NoviSpy variant 'appears to have been updated to avoid detection', said Donncha O Cearbhaill, head of Amnesty International's Security Lab.

NoviSpy requires authorities to physically access the phone to embed the spyware, whereas Pegasus can infiltrate phones with no interaction from the victim and without the phone ever being seized.

NSO Group maintains that its spyware is for usage against terrorism and crime, and that it halts any abuses it discovers.

John Scott-Railton of Citizen Lab said NSO Group continues to enable authoritarian governments even as Apple threat notifications and sophisticated forensic research increasingly expose the attacks.

SHARE Foundation said this was the largest documented wave of such surveillance in Serbia to date.

Of the 12 Apple-notified people who approached SHARE Foundation, one case has completed forensic analysis and 11 have not.

Serbian authorities reportedly denied the accusations, with the intelligence agency BIA calling the claims 'nothing more than trivial sensationalism' and saying the allegations indicate the individuals and organisations are acting in the interests of certain foreign intelligence services and pressure groups.

In the case of the Pegasus infection, it is rare for investigators to determine who specifically made use of the spyware.

Three infections are confirmed across at least 14 known targets, about 21 percent, or roughly one in five.

SHARE Foundation said signs point to Serbian police or secret service being behind the NoviSpy variant cases, with Amnesty International offering a similar assessment that the infections are carried out during detention by Serbian authorities.