Pegasus and NoviSpy: Cyber Espionage and Police Custody Hacking Strike Serbian Opposition
At least 14 Serbian activists, student movement organisers, and opposition politicians have been targeted in a spyware campaign combining remote Israeli cyber-weapons with physical phone tampering inside police stations. Technical findings published by Citizen Lab and Amnesty International confirm that zero-click Pegasus exploits and undetectable NoviSpy malware compromised target devices ahead of Serbia’s 2026 elections. As stolen private messages are broadcast on pro-government television and official Belgrade dismisses the evidence, the scandal highlights how digital surveillance is expanding across a European Union candidate state.
The initial technical evidence surfaced in August 2026, when Apple sent automated Threat Notifications to personal devices owned by opposition figures in Belgrade. The recipients included student protest leaders, civil society staff, a municipal councillor, and an opposition Member of Parliament. Laboratory checks by the Belgrade-based SHARE Foundation confirmed active exploitation between December 2025 and mid-2026—a period when parties were setting up campaign logistics for local and national votes.
Pegasus was not the only tool used.
Amnesty International found that Serbian police custody was used directly to install malicious software. Forensic analysis of an Android phone belonging to a detained student activist showed that a newly compiled version of "NoviSpy"—an Android malware strain designed to dodge security detection—was loaded onto the device while it sat confiscated during police interrogation.
This is a two-track operation. Pegasus works from remote servers without user interaction. NoviSpy requires a human handler inside a police station. Once installed, both systems give operators full access to encrypted chats, contact lists, stored files, real-time location data, and remote microphone control.
Stolen data moves quickly from police custody to state media. Private Viber chats taken from one victim’s phone were read aloud during a live broadcast on TV Informer, a pro-government television station.
Assembly Speaker Ana Brnabić called the forensic reports "idiotic," claiming the government had no knowledge of spyware use and that the student press conference was staged for "international audiences." Serbian law tells a different story. Article 143 of the Criminal Code makes unauthorized wiretapping and installing malicious software a criminal offence carrying prison terms.
How Cellebrite Kit Ended Up Loading Malware in Police Stations
The state apparatus operates a simple division of labor. Remote, expensive zero-click exploits like Pegasus cover high-value targets. Routine police detentions handle the rest through direct hardware tampering.
This physical access relies on forensic kit originally bought for standard police work. European donors supplied digital extraction hardware, including Cellebrite UFED units, to Serbia’s Ministry of Interior (MUP) for criminal investigations and anti-corruption operations. Amnesty International’s earlier 2024 investigation proved that officers used these same Cellebrite tools during station interviews to inject NoviSpy onto phones taken from journalists, with stolen data pointed directly at servers belonging to the Security Information Agency (BIA).
The 2026 NoviSpy variant was modified just before the latest wave of arrests. Developers altered its code structure to bypass Android security checks and hide from mobile antivirus software, ensuring security analysts faced a lag before antivirus definitions could capture the malware signatures.
Criminal complaints filed by the SHARE Foundation over previous phone-tampering incidents remain stuck in Serbian courts without a single prosecutor bringing charges against MUP or BIA personnel.
Political Fallout From the Novi Sad Station Disaster
The timing of the hacks ties directly to fallout from the November 2024 railway station canopy collapse in Novi Sad, which killed 15 people and triggered months of street protests over government corruption and shoddy public contracts.
Student groups led those demonstrations, organizing road blockades and campaign rallies that disrupted the government's economic messaging. When local elections took place on 29 March 2026, real-time access to student strategy gave state officials a clear operational advantage.
Illegal surveillance ruins the basic confidentiality required to run a political campaign. Intercepting internal messages lets state officials track voter outreach, map funding sources, identify whistleblowers, and break up demonstrations before activists gather on the street.
The television broadcasts add an extra layer of intimidation. Showing private Viber chats on national television forces campaign staff, investigative reporters, and student organizers to alter how they work.
Apple patched the iMessage zero-click vulnerability in its iOS 18.4.1 update, while security groups advised opposition members to turn on Lockdown Mode. Neither fix stops a police officer from plugging a cable into a confiscated phone during an interrogation.
EU Funding And Regional Diplomacy
The exposure of Belgrade’s surveillance operations creates a practical problem for European diplomats who have spent years prioritizing regional stability over democratic standards in Serbia.
That compromise is harder to maintain when military-grade hacking tools target elected MPs inside an EU candidate country.
The commercial path for these tools remains largely unmonitored. NSO Group states that Pegasus is sold exclusively to sovereign governments for fighting terrorism and serious crime, yet its digital footprint continues to turn up on devices owned by Serbian student campaigners, BIRN investigative reporters, and opposition politicians.
Western governments continue to fund legal reform programs across the Western Balkans while supplying forensic hardware that ends up repurposed for political intelligence. Serbian prosecutors have not indicted a single official over the misuse of Cellebrite equipment or BIA servers, leaving opposition parties to run election campaigns under continuous digital observation.
Sources: BalkanInsight, Citizenlab, SHARE