Prosecution of Protesters

Citizen Lab and the SHARE Foundation confirmed that the phone of University of Belgrade rector Vladan Đokić was infected with Pegasus spyware during 2026 through a zero-click exploit. Rade Bajić, a senior prosecutorial associate at the Public Prosecutor's Office for Organized Crime who had worked on the Generalštab case, received an Apple warning in August that his device had likely been targeted; an infection has not been confirmed. According to Citizen Lab, at least 16 members of Serbian civil society are now known to have been targeted with mercenary spyware. No state body has responded.

Since late 2023, several cases have been documented in which the phones of journalists, environmental activists, students and farmers were unlocked with Cellebrite tools and infected with NoviSpy spyware, mostly during interviews with the Security Intelligence Agency (BIA) or the police. Amnesty International published its report "A Digital Prison" in December 2024 and in March 2025 confirmed a Pegasus attempt against two BIRN journalists. The European Parliament condemned these practices in May 2025. On 2 September 2026, "Students in Blockade" said at least 14 people from the movement had been targeted.

The SHARE Foundation published forensic findings confirming that at least 14 people in Serbia had been targeted with commercial spyware since the beginning of 2026: members of the student movement, opposition activists, one member of parliament and one local councillor. Analysis carried out with the Citizen Lab and the Amnesty International Security Lab identified Pegasus, delivered through a zero-click exploit, and a new version of the domestic NoviSpy. The MP among the targets, Radomir Lazović, said the server infrastructure led to the BIA. No state body responded to the findings.