SHARE Foundation: Spyware targeting coincided with local election campaign

At least 14 people were targeted with advanced spyware in Serbia in early 2026, according to the SHARE Foundation. The organization said most of those affected were members of a student movement, activists and local councilors from opposition parties.

Andrijana of the SHARE Foundation told a news conference organized by the student movement that the targeting coincided with campaigning for local elections in March 2026. She said two forensic laboratories confirmed the foundation’s findings.

“

We can say that in most cases the targets were members of the student movement, activists and local councilors from opposition parties. Based on the available information, the targeting period coincides with the campaign for the local elections in March 2026.

Citizen Lab also confirmed that one device belonging to a student movement member had been infected with Pegasus. SHARE said the spyware can access photographs, contacts and other files, activate a device’s camera and microphone, take screenshots, and send data to whoever commissioned the attack, depending on the software used.

“

It has access to all the data on the device, photographs, contacts and other files. It can also activate the camera and microphone, as well as take screenshots.

Andrijana said the use of Pegasus costs millions and described the case as, based on the foundation’s information, the only known Pegasus infection worldwide in 2026. Two other cases became publicly known as NoviSpy. On one device, investigators found more than 1,500 screenshots created on command to monitor activity.

She alleged that the infections followed a pattern involving direct access to a person’s phone. According to her account, the person is taken to a police facility, separated from the phone, and the device is unlawfully unlocked. Data is copied before spyware is installed, after which the person returns home with the infected phone. She called the practice a serious breach of privacy because it can expose not only the target’s information but also data belonging to everyone in their contacts.

“

The use of spyware means unauthorized access not only to the targeted person’s data, but also to the data of other people who may be on the device, meaning everyone with whom that person is in contact.