Press Conference - September 2, 2026,

At Least 14 People Were Targeted by Spy Software, Pegasus Confirmed on a Student’s Phone

At the Student movement’s press conference, it was announced that different types of advanced spyware have targeted at least 14 people in Serbia since the beginning of 2026. Among those targeted are members of the student movement, activists, members of the IT blockade, a member of parliament, and an opposition council member.

An attack by Pegasus, one of the most sophisticated spy software programs in the world, was confirmed on the phone of student Jelena Kontić, while a new version of NoviSpy was found on two other devices. The SHARE Foundation’s findings were verified by the University of Toronto’s Citizen Lab and Amnesty International’s Security Lab.

Ela Zeković, a student at the Faculty of Political Sciences who opened the conference, said it was no longer a matter of suspicion that members of the movement were being monitored, but of forensically confirmed findings.

“We, students from all over Serbia, called a press conference to announce something that is no longer an impression, nor a suspicion. It is a forensically confirmed fact. Our colleagues were spied on by illegal software,” Zeković said.

She said that in mid-August, Apple warned a group of iPhone users that they had been targeted by a mercenary spyware attack, after which they contacted the SHARE Foundation.

“Today we know that 14 participants of the movement have been targeted. They are students, members of the IT blockade, activists, and there are also a member of parliament and an opposition councilman,” said Zeković.

She particularly pointed to the finding of Pegasus on one of the students’ phones.

“Pegasus, one of the most expensive and invasive monitoring tools in the world, was found on our colleague’s phone, inserted remotely, without a single click and without the user’s knowledge. This kind of software reads your every message, looks at every photo, and can turn on the microphone and camera by itself,” Zeković said.

According to her, students consider it particularly significant that the targeted people are those involved in the movement’s operational teams and election activities.

“It is completely clear to us that the targets were not randomly selected. Colleagues who are members of our operational teams were targeted. If someone is ready to do something like this during ten local elections, we do not need much imagination to imagine what he is preparing for the upcoming elections,” Zeković said.

SHARE: The Largest Documented Case in Serbia So Far

Andrijana Ristić from the SHARE Foundation presented the digital forensics results and explained what was found on the analyzed phones.

According to her, 12 people contacted SHARE after the Apple warning, while the analysis found that two more people’s devices were infected with the new version of NoviSpy. This identified at least 14 cases of targeting by advanced spyware.

“We can say that the targets in most cases were members of the student movement, activists and local councilmen from opposition parties. According to available information, the targeting period coincides with the campaign period for local elections in March 2026,” said Ristić.

Citizen Lab confirmed that Pegasus compromised a member of the student movement’s device. The attack was carried out via the iMessage application as a so-called zero-click attack, meaning it did not require a click, the opening of a message, or any other user interaction.

Ristić also explained what kind of access this software can provide an attacker.

“It has access to all the data on the device — photos, contacts, and other files. He can turn on the camera and microphone, as well as take screenshots. The data is sent to the master of the attack, depending on the software used,” Ristić explained.

In two other cases, researchers found a new version of NoviSpy. On one device, more than 1,500 screenshots were found to have been taken by spyware tracking user activity.

Unlike the Pegasus zero-click attack, NoviSpy’s documented cases required physical access to the phone.

“For that, the person needs to be taken to the police premises, after which he is separated from the phone. The phone is illegally unlocked, all data is copied from it, and then the spyware is installed, which runs all the time in the background, collects data, and sends it to a server whose IP address we managed to identify. After that, the person is allowed to go home with an infected phone,” explained Ristić.

She warned that this kind of surveillance does not end with the person whose phone has been compromised, because the device also contains data of all the people with whom that person communicates.

Jelena Kontić: Not Only My Privacy Was Violated

At the conference, student Jelena Kontić, a member of the “Student in Every Village” work unit, spoke about the phone on which the Pegasus attack was confirmed. According to information presented at the conference, her case is the first publicly documented case of Pegasus in the world during 2026.

Kontić said the Apple warning angered her most because it threatened the privacy of many more people through her phone.

“Everything we do is transparent. That’s why I was most angered by the notification I received. It wasn’t just my privacy and my safety that was violated, but the safety of all the people I communicated with — citizens, students, colleagues, and my family. As a result, they all became victims of someone’s surveillance,” Kontić concluded.

Explaining the scale of access that Pegasus enables, she added:

“Pegasus can open the camera and microphone at any time, see where you are, get into your messages, documents, and apps. Literally everything you have on your phone. It looks like your phone is in their hands.”

Kontić said that because of this, this case cannot be just a matter of privacy for a few students.

“If the price of the struggle is that our citizens and we all together pay our justice by having someone tap our phones, then this struggle does not only concern students, but all citizens,” she said.

Milica Najdamović: At First I Thought It Was a Generic Notification

Milica Najdamović, a student at the University of Niš, who received an Apple warning about an attempted attack in mid-August, also described her experience.

“At first I thought it was a generic notification or some advertisement. Only when I looked more closely did I realize that it said that a spy attack had been attempted on my phone. I forwarded the notification to a colleague who works in IT in Niš. We got in touch with colleagues from Belgrade and realized then that I wasn’t the only one who got it,” she said.

Milica Popović, a student at the Faculty of Dental Medicine, said it is especially disturbing that this kind of surveillance can include the most private part of people’s lives, and that students expect the pressure to continue.

“We are not surprised that 14 phones were hacked, nor that a man was beaten in Užice, but we have to remind you that these are criminal acts. We know what your dirty strategies are for gathering votes, but you can already feel in the air that students are winning,” Popović said.

Ognjen Rašić: This Shows What the Government Is Ready to Do

Ognjen Rašić, a student at the Faculty of Philosophy at the University of Niš, said the targeting is linked to students’ involvement in local elections in March and preparations for future parliamentary elections.

According to him, huge sums of money are allocated for these systems, while their targets are students and other people engaged in election activities.

“The government has spent hundreds of thousands of euros, maybe even millions, on software that monitors and eavesdrops on us. But we have nothing to hide. This is one of the main indicators of what this government is prepared to do, and it shows us that the regime is afraid,” Rašić claims.

He assessed that the timing of the targeting is important precisely because of the political context in which the attacks are taking place — after the local elections and at the time of preparations for the parliamentary elections.

Ana Toskić Cvetinović: It Is Not Just Unauthorized Wiretapping, But a Serious Violation of the Constitution

Ana Toskić Cvetinović, a lawyer and data protection expert, spoke about the legal consequences of the findings.

She warned that the case cannot be reduced to unauthorized wiretapping, but that it raises the issue of multiple criminal acts and serious violations of rights guaranteed by the Constitution of Serbia.

“It is not just unauthorized wiretapping, but a serious criminal offense and a violation of the Constitution,” said Toskić Cvetinović.

She reminded the public that, because of previously documented cases of spyware use in Serbia, criminal charges were filed as early as December 2024. However, the public still has no answer about their outcome, even almost two years later.

“Despite the criminal charges we have filed since December 2024, we do not know the status of these cases, and we do not have a single indictment for this type of abuse,” said Toskić Cvetinović.

She emphasized that Serbia is among the European countries with the largest number of publicly confirmed cases of advanced spyware use and that such surveillance cannot be limited to the immediate target, because compromising one device endangers the data of everyone the owner is in contact with.

“We Know What You’re Doing, We Got You, and You Won’t Get Away With It”

At the conference, the students said that the discovery of the surveillance will not force them to give up their activities.

“To those who ordered this, we only have to say this: we know what you are doing, we have caught you, and you will not get away with it. We are ready for the possibility that the intimidation will go even further. They will spend millions of our money to spy on us, and we will always have colleagues and associates ready to thwart them. Because of our training, they will change their screens and methods to attempt election theft, but we will adapt our training, and our response will be even stronger. We are smarter, we are ready, and three steps ahead. Neither the BIA (Security Information Agency) nor the police have disturbed us. It is not worth it — we are sticking together. They didn’t move us even an inch. We’re even more motivated than yesterday,” said Ela Zeković.

The conference was concluded with the words: “As for the elections: we are ready. We know what you do, we know how you steal, and we will not let you do that. We are going to win elections — together with the people who stand by us.”

The student movement will continue to inform the public about new findings and further steps regarding the spying cases.

Sincerely, Students in the blockade