Pegasus spyware found on a Serbian student's phone. Citizen Lab did not accuse the government, an American congressman did

The Canadian research institute Citizen Lab confirmed that Pegasus spyware from Israeli firm NSO Group was deployed on the iPhone of a member of a Serbian student protest movement. The attack came through a so-called zero-click exploit in iMessage, meaning the victim didn't have to open anything or click on anything. Traces of the infection date to the period from December 2025 to January 2026. According to CyberScoop, this is the first case of Pegasus deployment from 2026 that Citizen Lab has forensically confirmed. CyberScoop ↗ Citizen Lab ↗

But what's crucial is what's not in the report. Citizen Lab nowhere states who deployed the software — it only notes that the targeting occurred before key elections in 2026 — which were held locally on March 29. In that gap, everything else happens: the Serbian opposition and American congressman talk about the regime, the government agency denies it, and the forensic report stays silent.

What is documented and what is claimed

The difference between these two things is the entire story in this case. Forensically confirmed so far are three infections: one Pegasus on an iPhone documented by Citizen Lab, and two with a new version of the Android NoviSpy software — on two devices, one of which belonged to a student movement member. Citizen Lab ↗ SHARE Foundation ↗

The broader number circulating in media is of a different kind. The SHARE Foundation speaks of at least fourteen targeted people since the beginning of 2026 — among them are members of the student movement, activists, one member of the National Assembly and one local councilor, all from opposition parties. Twelve of them reached out to experts after receiving an alert, and eleven devices actually received such a notification from Apple.

But an Apple alert is not the same as a documented infection. It's a strong indicator that the person of mercenary spyware really was targeted — but it doesn't say whether the attack actually got into the phone. This is exactly why the difference between fourteen targeted and three confirmed infections is significant, even if it gets lost in headlines. SHARE Foundation ↗

The vulnerability through which the attack came was meanwhile patched by Apple in iOS 18.4.1.

NoviSpy returns — and once already had an address

The second finding carries more weight than it appears at first glance. NoviSpy is not an unknown software: Amnesty International named it in an investigation from December 2024 called "A Digital Prison". At that time it documented that Serbian police and intelligence services used forensic tools from firm Cellebrite to unlock phones of journalists and activists, and while they had the device in their hands, they installed NoviSpy on it. Amnesty International ↗

Amnesty attributed the software to the Security-Information Agency with high confidence at that time. This is why today's finding doesn't read as a new accusation, but as a continuation of a documented pattern.

How Belgrade responded

The Security-Information Agency rejected the claims about the use of spyware in Serbia. Politika (government-close) ↗

President Aleksandar Vučić chose a different position. He said he was also wiretapped, that he put up with it and that he's not complaining about it. Danas ↗ N1 ↗

From the opposition came a response from MP Radomir Lazović of the Green-Left Front, according to whom he was wiretapped at the same time as students and wants to turn to international institutions. Danas ↗ Two members of the People's Movement of Serbia were also reportedly targeted, and the party is demanding an investigation and accountability. Nova ↗

From abroad came a response from Republican congressman Joe Wilson, co-chair of the American Helsinki Commission. He wrote that it is unacceptable for Vučić's regime to use invasive surveillance software against Serbian citizens, and called it totalitarian technology turned against people who demand rule of law. N1 ↗

Why this is not just a Serbian matter

Serbia is a candidate country for European Union membership, and negotiations on the chapters on justice and fundamental rights are the part of the process where such findings are evaluated. But the case has another dimension: Pegasus is not an exotic tool of a distant regime. The same software has caused political crises within the union in recent years — in Poland, Hungary, Greece and Spain — and the European Parliament established a special investigative committee for it.

The case was also reported by Austrian public television, meaning a medium from a country that is among Serbia's largest foreign investors. ORF ↗

Limits of this perspective

Most sources on this topic come from the circle of Serbian media that are critical of the government — Nova, Danas and N1. This doesn't mean their findings are inaccurate, but it does mean the framing is theirs. The government perspective is represented in this text by Politika and the agency's denial, and we had nothing further to work with.

The second thing that needs to be said out loud: from the fact that NSO Group sells Pegasus exclusively to states, it does not follow which state used it in this particular case. It is an indication, not proof, and that is precisely why Citizen Lab did not treat it as sufficient grounds to name anyone. Who deployed the software remains open.

Finally, even congressman Wilson's statements are not a neutral assessment. Wilson is a long-time critic of Vučić's policy toward Moscow and co-sponsor of legislation meant to pressure Serbia — his reaction is a political act, not an investigative conclusion.

What hotinfo is monitoring

Illustrative photo: riot police in downtown Belgrade on the eve of a protest on March 15, 2025. Author Emilija Knezevic, Wikimedia Commons, CC BY 4.0.