Escalating Mercenary Spyware Campaign Targets Serbian Activists and Political Figures

Executive Summary

In early September 2026, the SHARE Foundation released a comprehensive report detailing a significant wave of digital surveillance targeting at least 14 individuals in Serbia, including student activists, opposition lawmakers, and local council members. This campaign, which utilizes advanced zero-click spyware, follows a global wave of threat notifications issued by Apple on August 13, 2026, to users across 110 countries. The findings highlight the persistent threat posed by private-sector exploit brokers and the increasing use of mercenary tools to suppress political dissent.

Threat Analysis

The identified campaign represents a sophisticated intersection of state-level interest and private-sector offensive capabilities. By leveraging tools like Pegasus—historically associated with the NSO Group—and the newly identified NoviSpy, operators have successfully compromised high-value targets without requiring user interaction. The timing of these infections, occurring amidst a period of political tension in Serbia, suggests a strategic effort to monitor and neutralize opposition movements.

Technical Details

The attacks primarily utilize zero-click exploits, which bypass traditional security measures by exploiting vulnerabilities in mobile operating systems. These tools allow for full device control, including the exfiltration of encrypted messaging data, real-time location tracking, and remote activation of microphones and cameras. The emergence of 'NoviSpy' alongside established tools like Pegasus indicates that threat actors are diversifying their arsenal to maintain persistence and evade detection by security researchers and mobile OS vendors.

Attribution Assessment

While Apple maintains a policy of not attributing these attacks to specific state actors, the nature of the targets—journalists, activists, and political figures—strongly points to state-sponsored or state-aligned entities. Serbian authorities have publicly denied any involvement, characterizing the reports as sensationalism. However, the technical sophistication required to deploy such tools suggests the involvement of a well-funded actor with access to high-end exploit chains.

Implications

The widespread use of mercenary spyware poses a critical threat to global human rights and democratic processes. As these tools become more accessible to a broader range of actors, the risk to civil society increases. The ability to silently monitor individuals without their knowledge undermines the integrity of private communication and political discourse, creating a chilling effect on activism and investigative journalism.

Recommendations

1. Enable 'Lockdown Mode' on all Apple devices if you are a high-risk individual (journalists, activists, politicians).
2. Ensure all mobile devices are updated to the latest firmware to receive critical security patches.
3. Exercise extreme caution regarding suspicious links or unexpected calendar invites, even if they appear to be from known contacts.
4. Utilize encrypted communication platforms that offer end-to-end encryption and verify security settings regularly.
5. Organizations should conduct regular security audits and provide digital hygiene training to staff operating in high-risk environments.