Serbian Student Protester’s iPhone Infected with Pegasus, Revealing Pre‑Election Spy Campaign

Security researchers have confirmed that a member of Serbia's student protest movement had their iPhone compromised with the NSO Group's Pegasus spyware as well as the lesser‑known NoviSpy tool, both deployed without any interaction from the target.

The intrusion was achieved through a zero‑click exploit, meaning the malicious code was installed simply by the phone receiving a data packet, a technique that bypasses the need for the user to open a link or install an app. Analysts traced the payload to the Pegasus platform, which is sold to governments for lawful investigations but has been linked to illicit surveillance in multiple jurisdictions.

The finding emerges amid a wave of demonstrations across Serbia, where students and other civic groups have been organizing protests ahead of national elections scheduled for later this year. Authorities have repeatedly dismissed claims of systematic monitoring, but the revelation that high‑profile activists were targeted suggests a coordinated effort to gather intelligence on dissenting voices.

Human‑rights organizations and European Union officials have expressed alarm, noting that the use of such powerful spyware against political opponents undermines democratic norms and may violate privacy protections enshrined in Serbian law. The incident adds to a growing list of countries where Pegasus has been deployed to monitor journalists, opposition figures, and activists.

Local prosecutors have opened a formal inquiry into the breach, and calls are mounting for the Serbian government to disclose any contracts or relationships with surveillance vendors. International watchdogs are urging the establishment of stricter oversight mechanisms to prevent future abuses, while legal experts warn that evidence of illegal spying could lead to civil suits or sanctions under EU digital‑rights frameworks.