Pegasus, NoviSpy variant spyware found on devices of Serbian activists
Citizen Lab has confirmed the first Pegasus infection of 2026, found on devices belonging to Serbian activists. The SHARE Foundation described the campaign, which also involves a NoviSpy variant, as the largest wave of spyware surveillance targeting Serbia to date.
Why this matters: Pegasus does not end up on an activist's phone by accident. Someone with access to very expensive, tightly controlled surveillance software made a deliberate choice to use it against civil society. Serbia has been in Citizen Lab's sights before. This latest wave suggests the targeting is getting broader, not narrower. When spyware scales up against activists, it tends to follow: journalists, lawyers, opposition figures, anyone inconvenient. The tool is the same. Only the target list changes.
Who should care: Privacy officers · Cybersecurity · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.