Serbian authorities have flatly denied allegations that at least 14 members of civil society — including student activists, opposition politicians, and NGO workers — were targeted with advanced spyware in what digital rights groups are calling the largest documented wave of such surveillance in the country's history.

The findings were published Wednesday by the Share Foundation, a Serbian digital rights organisation, and corroborated by the Citizen Lab, a research unit at the University of Toronto that conducts forensic analyses of spyware attacks. Researchers confirmed that at least one phone belonging to a member of Serbia's student protest movement had been infected with Pegasus, military-grade spyware developed by the Israeli company NSO Group and sold exclusively to state and government agencies. Pegasus grants attackers total access to a targeted device — including messages, contacts, photos, and the ability to secretly activate the microphone and camera. Its use is illegal in Serbia. The infections were discovered in August after Apple notified users in 110 countries that they had likely been victims of mercenary spyware.

Serbia's intelligence agency, the Security Information Agency (BIA), dismissed the allegations as "trivial sensationalism" and accused those raising them of "acting in the interests of certain foreign intelligence services and pressure groups." President Aleksandar Vučić, who has held power for more than a decade and whose government critics say has gradually weakened democratic institutions, said the students had "merely expressed their suspicions without a single piece of evidence." Parliamentary speaker Ana Brnabić, a senior figure in the ruling Serbian Progressive party, was equally dismissive: "Absolutely not. I do not believe a single word they've said."

The targeted individuals are connected to a student movement that has challenged the government since late 2024, when the collapse of a railway station canopy in Novi Sad — a city in northern Serbia — triggered nationwide protests. The movement has since grown into one of the largest student mobilisations in Europe. Researchers noted that the spyware infections appear to have occurred around March's local elections and warned of a pattern ahead of snap elections scheduled for October 2026. "This is the largest documented wave of surveillance in Serbia so far," said Andrijana Ristic of the Share Foundation. "We imagine that the local elections were basically used as a test for the ruling party." John Scott-Railton of the Citizen Lab added that Serbia's "peaceful pro-democracy movement is being aggressively targeted with mercenary spyware ahead of key 2026 election cycles."

This is not the first time Serbian authorities have faced such accusations. In 2024, a separate investigation revealed that Serbian activists had been targeted with NoviSpy, a spyware with previously documented connections to Serbian state actors. In February 2025, two journalists from the Balkan Investigative Reporting Network (BIRN) were targets of a failed Pegasus installation attempt. Despite the official denials, student activist Milica Popović, one of those targeted, said the experience left her feeling exposed but resolute. "If their intention was to frighten us, or make us stop, it will not work," she said. NSO Group, which has faced international scrutiny and a US court ban on targeting users of Meta products including WhatsApp, was approached for comment but had not responded at the time of publication.