Pegasus, NoviSpy variant found on 14 Serbian activists' devices

September 2, 2026 at 08:03 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers confirmed the first Pegasus spyware infection of 2026 and a new NoviSpy variant on devices of Serbian activists. The SHARE Foundation said 14 people were targeted, including a member of parliament and a local official. The infections coincided with protests and upcoming elections.

Key Facts

The SHARE Foundation said 14 people were targeted, including one member of parliament and a local government official.
Citizen Lab confirmed the Pegasus infection of a student activist with "high probability".
Amnesty International confirmed two devices were infected with a new version of NoviSpy.
The infections coincided with the build-up to local elections in March and October parliamentary elections.
One NoviSpy variant infection came after authorities took a student's phone during police questioning.

Spyware Infections

The SHARE Foundation said Wednesday it found 14 people targeted in all, including one member of parliament and a local government official. The University of Toronto's Citizen Lab confirmed the Pegasus infection of a student activist with "high probability". Amnesty International confirmed that two devices had been infected with a new version of the NoviSpy spyware. One NoviSpy variant infection came after authorities took a student's phone during police questioning. The same spyware was found on another device after private messages from the phone were disclosed by a media outlet that favors the ruling party.

Political Context

The SHARE Foundation noted that the infections coincided with the build-up to key local elections in March. Those elections were viewed as a test of the ruling Serbian Progressive Party. Student protests have been rising in the wake of the 2024 Novi Sad railway station canopy collapse. The infections also occurred in advance of October parliamentary elections.

Attribution Assessment

The SHARE Foundation said signs point to Serbian police or secret service being behind the NoviSpy variant cases. Amnesty International offered a similar assessment. Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, said the findings show Serbian student activists continue to be targeted with invasive spyware.