Attacks on protesters

In an interview published by BIRN on 13 October 2026, Momčilo Marjanović, a long-time SNS activist, alleged that the ruling party organised and paid groups of men who used force against students and citizens at protests. He says the groups were stationed in the "Ćacilend" camp in Belgrade during the 15 March 2025 protest, that police coordinated with the camp, and that cash came from the director of a Novi Sad public utility company. The director declined to answer BIRN's questions.

Since late 2023, several cases have been documented in which the phones of journalists, environmental activists, students and farmers were unlocked with Cellebrite tools and infected with NoviSpy spyware, mostly during interviews with the Security Intelligence Agency (BIA) or the police. Amnesty International published its report "A Digital Prison" in December 2024 and in March 2025 confirmed a Pegasus attempt against two BIRN journalists. The European Parliament condemned these practices in May 2025. On 2 September 2026, "Students in Blockade" said at least 14 people from the movement had been targeted.

The SHARE Foundation published forensic findings confirming that at least 14 people in Serbia had been targeted with commercial spyware since the beginning of 2026: members of the student movement, opposition activists, one member of parliament and one local councillor. Analysis carried out with the Citizen Lab and the Amnesty International Security Lab identified Pegasus, delivered through a zero-click exploit, and a new version of the domestic NoviSpy. The MP among the targets, Radomir Lazović, said the server infrastructure led to the BIA. No state body responded to the findings.