Update
Draft Law Amending the Law on Prevention of Corruption
Update – the reform is now law. The National Assembly adopted amendments to the Law on Prevent...
On 2 September 2026 the SHARE Foundation published findings confirming that at least 14 people in Serbia have been targeted with commercial spyware since the beginning of 2026. The confirmed targets are members of the student movement, opposition party activists, one member of parliament and one local councillor - that is, people active in the protest movement and in opposition politics during the period that included the 29 March local elections.
The cases came to light through Apple's threat notifications. Twelve people who received such a warning in August 2026 contacted the SHARE Foundation for forensic analysis; that analysis, carried out with the Citizen Lab at the University of Toronto and the Amnesty International Security Lab, confirmed two further infections that had not been notified. The pattern is therefore not a series of isolated incidents but sustained targeting of one political milieu.
Two tools were identified. On a student's device, Citizen Lab confirmed infection with Pegasus, the military-grade product of the Israeli NSO Group, delivered through a zero-click iMessage exploit between December 2025 and January 2026 - meaning the target had to do nothing at all for the phone to be compromised. Separately, the Amnesty Security Lab identified a new 2026 version of NoviSpy, the domestically built Android spyware, rewritten to evade detection and requiring physical access to the device. Both give the operator access to messages, contacts, photos, files and app data, and allow remote activation of the screen, microphone and camera. Neither tool has any lawful basis for use in Serbia.
The member of parliament among the targets is Radomir Lazović, co-chair of the Green-Left Front, who confirmed to Nova that Apple notified him roughly two weeks ago. Lazović connects the timing to two things: opposition coordination during the local elections, and his contacts with EU institutions and member state officials in Brussels, Strasbourg, Paris, Berlin and Stockholm. He states that the server infrastructure identified in the forensic analysis leads to the Security Intelligence Agency (BIA). No state body has responded to these findings.
This is not the first documented case. In December 2024 Amnesty International documented in "A Digital Prison" that NoviSpy had been installed on the phones of journalists and activists during police "informative talks", with extracted data sent to servers belonging to the BIA, and that the Cellebrite forensic extraction tool - donated to the Ministry of Interior - had been used to unlock devices beforehand. Criminal complaints filed after those cases remain pending, and no one has been held accountable. Installing spyware on someone's device is a criminal offence under Serbia's Criminal Code.
Against this backdrop, the accession dimension is the gap between commitment and track record. As CRTA noted at the time, the 2026 EU Rule of Law report already listed spyware among the pressures on journalists in Serbia, and recorded the BIA's "informative talks" and the downgrading of civic space under checks and balances. What the new findings show is not a new problem but the absence of any consequence for an old one: two years after the first forensic confirmation, the practice has continued, it has extended from journalists to the student movement and elected representatives, and the institutional response has been silence. In July 2026 EU member states did not reach unanimity to open Cluster 3 in Serbia's negotiations, with rule of law concerns among the reasons cited. Unlawful surveillance of political opponents, left uninvestigated, has a chilling effect that no reform document can offset.
CRTA documents the shrinking space for political participation in Serbia, and will follow whether the prosecution acts on these findings.
The cases came to light through Apple's threat notifications. Twelve people who received such a warning in August 2026 contacted the SHARE Foundation for forensic analysis; that analysis, carried out with the Citizen Lab at the University of Toronto and the Amnesty International Security Lab, confirmed two further infections that had not been notified. The pattern is therefore not a series of isolated incidents but sustained targeting of one political milieu.
Two tools were identified. On a student's device, Citizen Lab confirmed infection with Pegasus, the military-grade product of the Israeli NSO Group, delivered through a zero-click iMessage exploit between December 2025 and January 2026 - meaning the target had to do nothing at all for the phone to be compromised. Separately, the Amnesty Security Lab identified a new 2026 version of NoviSpy, the domestically built Android spyware, rewritten to evade detection and requiring physical access to the device. Both give the operator access to messages, contacts, photos, files and app data, and allow remote activation of the screen, microphone and camera. Neither tool has any lawful basis for use in Serbia.
The member of parliament among the targets is Radomir Lazović, co-chair of the Green-Left Front, who confirmed to Nova that Apple notified him roughly two weeks ago. Lazović connects the timing to two things: opposition coordination during the local elections, and his contacts with EU institutions and member state officials in Brussels, Strasbourg, Paris, Berlin and Stockholm. He states that the server infrastructure identified in the forensic analysis leads to the Security Intelligence Agency (BIA). No state body has responded to these findings.
This is not the first documented case. In December 2024 Amnesty International documented in "A Digital Prison" that NoviSpy had been installed on the phones of journalists and activists during police "informative talks", with extracted data sent to servers belonging to the BIA, and that the Cellebrite forensic extraction tool - donated to the Ministry of Interior - had been used to unlock devices beforehand. Criminal complaints filed after those cases remain pending, and no one has been held accountable. Installing spyware on someone's device is a criminal offence under Serbia's Criminal Code.
Criminal complaints filed after those cases remain pending, and no one has been held accountable.
Against this backdrop, the accession dimension is the gap between commitment and track record. As CRTA noted at the time, the 2026 EU Rule of Law report already listed spyware among the pressures on journalists in Serbia, and recorded the BIA's "informative talks" and the downgrading of civic space under checks and balances. What the new findings show is not a new problem but the absence of any consequence for an old one: two years after the first forensic confirmation, the practice has continued, it has extended from journalists to the student movement and elected representatives, and the institutional response has been silence. In July 2026 EU member states did not reach unanimity to open Cluster 3 in Serbia's negotiations, with rule of law concerns among the reasons cited. Unlawful surveillance of political opponents, left uninvestigated, has a chilling effect that no reform document can offset.
CRTA documents the shrinking space for political participation in Serbia, and will follow whether the prosecution acts on these findings.
