Pegasus Spyware: US Congress Reacts to Serbia Surveillance
Citizen Lab forensically confirmed Pegasus spyware on the phone of a Serbian student movement member. The US Congress has reacted, while Ana Brnabic dismissed the claims as nonsense.
The Canadian research group Citizen Lab, based at the University of Toronto, announced on September 2 that it had forensically confirmed an infection with Pegasus spyware, made by the Israeli company NSO Group, on the phone of a member of Serbia’s student protest movement. Citizen Lab carried out the analysis together with the Serbian digital rights group SHARE Foundation, and the finding comes less than two months before parliamentary elections scheduled for October 25.
According to the finding, traces of the infection date from December 2025 to January 2026, though Citizen Lab notes this does not rule out other, still unanalyzed infections. The breach relied on a so called zero click flaw in Apple’s iMessage service, meaning the victim did not have to click a link or take any action at all for the phone to be infected. Citizen Lab says the flaw was not patched until iOS version 18.4.1. The activist whose phone was analyzed asked that their identity remain confidential.
Ognjen Rasic (21), a communications student from Nis and a member of the student movement, received Apple’s warning about an attempted spyware attack on August 13. Speaking to the Financial Times, which was first to report the scale of the case, he explained why he believes he was targeted.
“They’re afraid because the student movement is the most influential political force,” Rasic said.
SHARE Foundation had documented 14 cases of spyware targeting members of the student movement and civil society by August 2026, the largest known wave of this kind of surveillance in Serbia to date. According to N1, citing the Financial Times, 12 people received Apple’s threat notification in August and subsequently contacted SHARE Foundation. The foundation says the surveillance coincided in timing with the campaign for the local elections in March 2026.
How NoviSpy worked
Alongside Pegasus, domestic software called NoviSpy was found on Android devices in two cases. Unlike Pegasus, it has to be physically installed on a device, but once installed it continuously collects data and can remotely switch on a phone’s microphone and camera. In one of those two cases, according to available findings, NoviSpy was installed while the person was being held by police, ahead of the March local elections. Researchers describe a recurring pattern: a person is brought into a police station, separated from their phone, the device is unlocked, data is copied, and then software is installed that sends data to a server in the background.
NoviSpy was first publicly described in a 2024 Amnesty International report, which labeled Serbia a “digital prison.” Citizen Lab says Pegasus, once installed, also copies content from encrypted apps, including Signal and WhatsApp.
According to a statement from the Students in Blockade movement, those affected include, besides Rasic, Faculty of Political Sciences student Ela Zekovic, student Jelena Kontic, BIRN analyst Milos Damnjanovic, and opposition MP Radomir Lazovic. The statement also described what the software allows an attacker to do.
“This software reads every message, sees every photo, they can turn on the microphone and camera on the phone,” the students’ statement said.
Reaction from Washington
The first reaction from the US Congress came from Republican Congressman Joe Wilson, one of the sponsors of a bill that would require the United States to take measures against Serbia over what he has previously called “serious backsliding” in democracy and the rule of law, as well as cooperation with Russia, China and Iran. Wilson responded on X.
“It is unacceptable that Vucic’s regime used invasive surveillance spyware to target Serbian citizens. This totalitarian technology is being weaponized against a free people demanding the rule of law,” Wilson wrote.
Citizen Lab researcher John Scott-Railton summed up the significance of the wave of Apple warnings for the Financial Times.
“This new wave of Apple notifications shows that a peaceful pro-democracy movement is being aggressively targeted,” Railton said.
National Assembly Speaker Ana Brnabic, a close associate of President Aleksandar Vucic, flatly rejected the students’ claims in comments to the Financial Times.
“Ridiculous, complete nonsense,” Brnabic said, arguing it was an attempt to cast the upcoming election as irregular before it even takes place.
The editor in chief of the pro government tabloid Informer, Dragan J. Vucicevic, made a remark on a television broadcast, cited in the Financial Times report, that the paper recorded as confirmation of the surveillance.
“You know we monitor their closed WhatsApp and Viber groups. How we managed that, we won’t tell you,” Vucicevic said.
Among the sources reviewed for this report, there is no response from the Security Information Agency (BIA) or the Interior Ministry (MUP) to the surveillance allegations. NSO Group was asked for comment, according to the Financial Times. NSO Group was placed on a US Commerce Department blacklist during the Biden administration, barring it from doing business with American companies, after its software was found on the phones of US embassy staff in East Africa.
