How to tell whether your phone has been infected with spyware

Spyware can take over nearly every part of a phone, yet the most sophisticated programs may leave little visible evidence. That question has drawn new attention in Serbia after students involved in the blockades said they had been targeted.

Canadian digital security experts confirmed that at least one activist’s phone had been infected with Pegasus, spyware made by the Israeli company NSO. The SHARE Foundation later found through forensic analysis that the devices of two other people had been infected with a newer version of NoviSpy, malware first discovered in Serbia in 2024.

At least 14 people in Serbia have been targeted by different forms of advanced spyware since the beginning of 2026. The targets included members of the student movement and activists, as well as an opposition member of parliament and a local opposition councillor.

SHARE Foundation experts say spyware can access all data stored on a device, including communications, contacts, photographs, application content and other files. It can also secretly record the screen and activate the microphone or camera.

Programs such as Pegasus and Predator are particularly difficult to identify and are often detected only through forensic analysis. More subtle warning signs can include an overheating or slowing device, unexpected changes in connectivity, or a camera or microphone activating when it is not being used.

An official threat alert from Apple, Meta or Google may offer a clearer indication that a person has been individually targeted. Apple says its threat notifications are intended for users who may have been targeted by commercial spyware used by “mercenary attackers,” possibly because of who they are or what they do. The company says such attacks cost millions of dollars and often remain usable only for short periods, meaning most users will never be targeted.