At least 14 individuals from various parts of Serbian civil society were reportedly infected with advanced spyware earlier this year, according to the digital rights organization Share Foundation. This marks the largest known wave of such infections in Serbia. The incidents were uncovered in August after Apple notified users in 110 countries that they might have been targeted by mercenary spyware. The Citizen Lab, a research group that investigates digital espionage, found evidence that at least one of the infected individuals was targeted with Pegasus, a powerful spyware developed by the NSO Group. Pegasus allows attackers to gain full control of a device, enabling the monitoring of messages, calls, and even camera and microphone feeds. The individuals targeted included members of a student movement in Serbia that has been critical of the government of Aleksandar Vučić since 2024. This movement grew out of widespread protests following the collapse of a train station that winter and is considered one of the largest student movements in Europe. Vučić has been in power for over a decade, and critics argue that his administration has weakened democratic institutions and drawn Serbia closer to Russia. However, there is no evidence that Vučić’s government was behind the spyware attacks. Ana Brnabić, the parliamentary speaker and a senior member of the ruling Serbian Progressive Party, denied the allegations, stating she did not believe any of the claims made by the students or Share. Share suggested that the timing of the attacks—during March’s local elections—may have been a test for the ruling party ahead of snap elections scheduled for October. “This is the largest documented wave of surveillance in Serbia so far,” said Andrijana Ristic, a policy adviser at Share. John Scott-Railton, a researcher at the Citizen Lab, noted that the recent Apple alerts and forensic findings indicate that Serbia’s pro-democracy movement is being actively targeted with mercenary spyware ahead of key elections in 2026. Milica Popović, one of the students targeted, described the attacks as “cruel,” expressing feelings of exposure and vulnerability. However, she emphasized that the attack would not deter her or the movement. “If their intention was to frighten us or make us stop, it will not work,” she said. NSO Group, the Israeli-based company that developed Pegasus, has faced scrutiny for its ties to authoritarian regimes and its use of the spyware against journalists, activists, and dissidents. The company is now under U.S. ownership and has been trying to rebrand itself as an “ethical” spyware provider, despite being banned by a U.S. court from targeting WhatsApp users and Meta products. The recent attack raises questions about whether the company’s efforts to rebrand are genuine. NSO Group has not yet commented on the latest allegations.