Mercenary Spyware Campaign Targets Serbian Civil Society Ahead of National Elections

Executive Summary

In a significant escalation of digital surveillance in the Balkans, the SHARE Foundation has confirmed that at least 14 members of Serbian civil society, including student activists, opposition lawmakers, and local officials, were targeted by advanced mercenary spyware. This discovery follows a massive wave of threat notifications issued by Apple in mid-August 2026, which alerted users in 110 countries to potential state-sponsored or commercial surveillance targeting. The campaign appears to have been active in the months leading up to Serbia's March 2026 local elections, raising urgent concerns regarding the integrity of the upcoming October parliamentary polls.

Threat Analysis

The identified campaign represents a sophisticated use of commercial surveillance tools to suppress political dissent. Unlike broad-spectrum malware, these operations are highly targeted, focusing on individuals based on their influence, political affiliation, or role in protest movements. The use of such tools against domestic political actors suggests a shift toward using high-end, zero-click exploits to maintain an information advantage during contentious election cycles.

Technical Details

Forensic analysis conducted by The Citizen Lab and local partners confirmed the presence of NSO Group’s Pegasus spyware on the devices of targeted individuals. The infection vector is assessed to be a zero-click iMessage exploit, which allows for full device compromise without any user interaction. This method bypasses traditional security prompts, making detection extremely difficult for the average user. The persistence of these implants allows attackers to exfiltrate encrypted communications, track real-time location, and access microphone and camera feeds.

Attribution Assessment

While the specific operator behind this campaign remains under investigation, the use of Pegasus points to a government-aligned entity. The timing of the infections—coinciding with local election cycles—strongly suggests a state-sponsored motivation. The SHARE Foundation’s findings indicate that this is the largest documented wave of such infections in Serbia to date, suggesting a well-resourced actor with access to premium exploit chains.

Implications

The deployment of mercenary spyware against civil society members creates a chilling effect on democratic participation. When activists and opposition figures are subjected to constant, invisible surveillance, the ability to organize and communicate safely is severely compromised. Furthermore, the reuse of these exploits by various actors globally highlights the systemic risk posed by the commercial spyware market.

Recommendations

1. Enable Lockdown Mode: High-risk individuals should immediately enable Apple’s Lockdown Mode to restrict the attack surface of their devices.
2. Regular Audits: Organizations should conduct periodic forensic audits of devices used by personnel in sensitive roles.
3. Secure Communication: Transition to end-to-end encrypted messaging platforms that offer additional privacy features and verify contacts out-of-band.
4. Software Hygiene: Ensure all mobile operating systems are updated to the latest versions to mitigate known vulnerability chains.