Apple’s Global Alert Sparks Alarm in Serbia
Around the world, iPhone users began receiving alarming notifications in August, warning that their devices had likely fallen victim to mercenary spyware. The alerts, dispatched by Apple, covered 110 countries and caught the eye of Serbian civil society almost instantly. Among the first to feel the fallout were at least 14 people linked to the country’s vibrant protest scene, including members of a student movement that has been challenging President Aleksandar Vučić’s government since 2024. The scale of the infections marks what digital‑rights group Share calls the largest documented wave of spyware infection ever recorded in Serbia.
The timing could not have been more provocative. The surge coincided with March’s local elections, leading Share’s policy adviser Andrijana Ristic to suggest the operation was a rehearsal for the snap general election slated for October. “This is the largest documented wave of surveillance in Serbia so far,” she noted. “We imagine … that the local elections were basically used as a test for the ruling party to see [the spyware’s] strengths, but also to see the amount of pressure they are able to exert over the students and the opposition.”
Citizen Lab Exposes Pegasus Links to Student Targets
Forensic analysis by the Toronto‑based Citizen Lab confirmed the gravity of the threat. Their report, released on Wednesday, identified at least one Serbian individual who had been compromised by the NSO Group’s Pegasus spyware—a tool renowned for granting attackers “total access to the device.” Senior researcher John Scott‑Railton warned that “Serbia’s peaceful pro‑democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles.”
While Pegasus remains the most notorious, other malware such as NoviSpy has also been deployed against the same activists. Previous investigations have already tied NoviSpy to Serbian state actors, although Vučić’s administration continues to deny any involvement. Parliamentary Speaker Ana Brnabić, a senior member of the ruling Serbian Progressive Party, dismissed the allegations outright. “Absolutely not,” she told Euronews Serbia TV. “I do not believe a single word they’ve [students, Share] said.”
Student Voices: Cruel Hacks, Unbroken Resolve
For Milica Popović, one of the students who fell prey to the intrusion, the experience was nothing short of brutal. “Thinking that someone may have entered my private space without my knowledge made me feel so exposed,” she recounted. Yet, despite the emotional toll, the attacks have not shaken her determination. “If their intention was to frighten us, or make us stop, it will not work,” she asserted. The movement, which coalesced after the collapse of a train station that winter, now counts as one of the largest student protests in Europe, a thorn in the side of a government that has been in power for more than a decade.
Vučić’s tenure has been marked by accusations of institutional erosion and a pivot toward Moscow. Critics argue that the state’s democratic fabric has been steadily unwoven, a narrative that gains fresh urgency as the government faces renewed scrutiny over its alleged use of surveillance tools to silence dissent.
NSO Group: From Israeli Military Link to US‑Owned “Ethical Spyware”
NSO Group, the creator of Pegasus, began life as an Israeli firm with deep military ties. Today, the company is under US ownership and is actively seeking entry into the American market, even as it attempts to shed its reputation as a purveyor of repressive technology. The firm has been permanently barred by a US court from targeting WhatsApp users and other Meta products, yet the latest Pegasus incident remains of unknown vector.
The firm’s rebranding efforts have been complicated by a string of high‑profile breaches. “Today, Pegasus is still being used to hack people campaigning for democracy. NSO spent a decade promising reform, yet their spyware is still an instrument of political repression,” Scott‑Railton added. When approached for comment, NSO Group declined to provide further insight at this time.
The fallout extends beyond the courtroom. European lawmakers and human‑rights organisations are pushing for stricter controls on spyware exports, fearing a new era where sophisticated hacking tools become weapons for authoritarian regimes. As the debate rages, the case of Serbia’s student activists stands as a stark reminder of how technology can be weaponised against peaceful protest.
Why it Matters
The spyware onslaught against Serbian students is more than a domestic security scare; it signals a broader, alarming trend where cutting‑edge surveillance technology is being wielded to stifle democratic voices ahead of critical elections. The fact that Apple’s global threat‑notification system uncovered the breach underscores how intertwined our digital lives have become with political freedom. If left unchecked, such tools could set a dangerous precedent, emboldening governments worldwide to deploy mercenary spyware as a standard tactic for silencing opposition. This episode demands urgent international attention, stronger regulatory frameworks, and a reaffirmation of the right to protest without fear of digital intrusion.
