Verify any claim · lenz.io
“At least 14 students, activists, and opposition politicians in Serbia were targeted with advanced spyware beginning in 2026, in the country’s largest documented spyware-surveillance wave.”
The conclusion
The evidence supports the reported surveillance wave involving at least 14 Serbian students, activists, and opposition politicians. Forensic researchers identified advanced tools including Pegasus and NoviSpy, and described the episode as Serbia's largest documented spyware wave. One infection trace dates to December 2025, making the stated 2026 start a minor simplification.
Caveats
- At least one documented infection window began in December 2025, slightly complicating the stated 2026 start.
- Many news reports derive the 14-person count and “largest documented wave” description from the same underlying SHARE Foundation investigation.
- Being targeted does not necessarily mean every device was successfully infected, and Serbian authorities denied conducting unlawful surveillance.
Fact-check inside the tools you already use
Connect Lenz to ChatGPT, Claude, or WhatsApp and check a claim mid-conversation.
Or create a free account to bookmark this verification and run your own checks.
Sources
Ranked by source quality and relevance
The SHARE Foundation has documented at least 14 cases of individuals in Serbia’s student movement and civil society, as well as an opposition Member of Parliament, who recently received Apple Threat Notifications. … These notifications and forensic confirmation highlight the aggressive mercenary spyware targeting of the peaceful pro-democracy movement with mercenary spyware ahead of key 2026 election cycles.
A total of 14 students, activists, and opposition politicians have been spied on using unauthorized software via mobile phones since the beginning of the year. "This is the most massive recorded wave of such spyware use in the country," she explained.
A total of 14 students, activists and opposition politicians have been spied on with illicit software via mobile phones since the beginning of the year. "This is the most massive recorded wave of the use of such spyware in the country," she explained.
At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday. … The wave of spyware infections, discovered in August after Apple notified people in 110 countries that they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement.
At least 14 people from across Serbian civil society were targeted with advanced spyware earlier this year in what the digital rights group Share Foundation said was the largest documented wave of such infection in Serbia to date.
At least 14 people were affected by the intrusions in early 2026, marking the largest documented wave of such tactics in the country, according to a report published on Sept 2 by Share Foundation, a Serbian human rights group. … A dozen people, including student organisers and two opposition politicians, contacted Share after receiving notifications from Apple Inc on their iPhones that they were targeted by spyware, according to the report.
At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday. … The wave of spyware infections, discovered in August after Apple AAPL.O notified people in 110 countries they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement. … Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, SHARE said.
Share Foundation said on Wednesday that at least 14 people in Serbia had been targeted with advanced spyware in 2026 in “the largest documented wave of such surveillance in the country to date”.
At least 14 people across Serbia’s civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said Wednesday. … The wave of spyware infections, discovered in August after Apple notified people in 110 countries that they had likely been victims of mercenary spyware, marks the largest documented wave of such infections in Serbia to date, the SHARE Foundation said in a statement.
There were at least 14 devices compromised, with one reportedly infected with Pegasus and others infected with NoviSpy, a government-developed spyware. … Confirmed cases of targeting include members of a student movement, activists, opposition party members in parliament and a local councilor, the group said.
The SHARE Foundation said Wednesday that it found 14 people targeted in all, including one member of parliament and a local government official.
At least 14 Serbians have been targeted with advanced spyware since December, with victims including a member of Parliament, a local opposition politician and student protesters, according to digital forensic researchers.
BELGRADE – At least 14 people in Serbia were targeted with advanced spyware since the beginning of 2026 – the largest documented wave of such surveillance in the country to date, announced SHARE Foundation on 2 September. … “Those targeted include members of the student movement, activists, a member of parliament, and a local councilor, all from opposition parties. The timing coincides with the local elections held on 29 March 2026”, the statement from SHARE Foundation says.
Yesterday, SHARE Foundation announced that at least 14 people in Serbia were targeted with advanced spyware since the beginning of 2026 – the largest documented wave of such surveillance in Serbia to date.
Students in Blockade announced today that at least 14 academics, members of the "IT Blockade" initiative, activists, one member of parliament, and one local councilor, were spied on with unauthorized software via mobile phones. Representative of the Share Foundation, Andrijana Ristić, said they established that at the beginning of 2026, at least 14 people were targeted with advanced types of spyware. "We can say that the targets in the majority of cases were members of the student movement, activists, and local councilors from opposition parties," she said.
The Citizen Lab said it found high-confidence indicators of infection on the individual's iPhone across December 2025 and January 2026, but that this did not rule out further infections. … The notification was among at least 14 documented by the SHARE Foundation involving members of Serbia's student movement and civil society, as well as an opposition member of parliament. The Citizen Lab said the targeting came ahead of key 2026 election cycles.
The SHARE Foundation has confirmed that at least 14 people in Serbia were targeted with advanced spyware since at the beginning of 2026 – the largest documented wave of such surveillance in the country to date. … Those targeted include members of the student movement, activists, a member of parliament, and a local councilor, all from opposition parties.
EDRi member SHARE Foundation has confirmed that at least 14 people in Serbia were targeted with advanced spyware since the beginning of 2026 – the largest documented wave of such surveillance in the country to date. … Those targeted include members of the student movement, activists, a member of parliament, and a local councilor, all from opposition parties.
On 2 September 2026 the SHARE Foundation published findings confirming that at least 14 people in Serbia have been targeted with commercial spyware since the beginning of 2026. … The confirmed targets are members of the student movement, opposition party activists, one member of parliament and one local councillor - that is, people active in the protest movement and in opposition politics during the period that included the 29 March local elections.
According to the SHARE Foundation, at least 14 people have been targeted with advanced spyware since the beginning of 2026, which it described as the largest documented wave of such surveillance in Serbia to date.
Students in blockade announced today that at least 14 academics, members of the "IT blockade" initiative, activists, one member of parliament and one local councilor, were spied on with unauthorized software via mobile phones. ... "We can say that the targets in most cases were members of the student movement, activists and local councilors from opposition parties. According to available information, the targeting period coincides with the period of the local election campaign in March 2026," said SHARE Foundation representative Andrijana. ... Serbia is today the country in Europe with the highest number of confirmed cases of spyware, mostly of those who dared to say something critical in the public space," she pointed out at the press conference.
A total of 14 students, activists, and opposition politicians have been spied on with illicit software via mobile phones since the beginning of the year. Since the beginning of the year, 14 people have been targeted with advanced spyware, as confirmed by an analysis by the Share Foundation and announced at the conference. This is the highest number of monitored people in a single "wave" in Serbia, they added.
Student of the Faculty of Political Sciences Ela Zeković said at a press conference that 14 activists of the student movement, as well as a member of parliament and an opposition councilor, were spied on at the time when local elections were held in ten municipalities in Serbia. She said that this is a "forensically confirmed fact", and that they were "tracked by one of the most advanced softwares sold only to states."
At least 14 people in Serbia – members of the student movement, activists, an opposition MP and a local councilor, were wiretapped with advanced spyware in the period around the local elections in March this year, the SHARE Foundation announced. According to the SHARE Foundation, which deals with digital security, this is the most massive documented wave of use of such software in the country so far.
At least 14 students, activists, and opposition leaders received information from Apple, whose users they are, that their phones were infected with advanced spyware, which can extract all data, correspondence, and photos from the phone.
At least 14 people linked to Serbia’s civil society and opposition have been targeted with advanced spyware since the beginning of 2026, according to digital rights group SHARE Foundation. … SHARE Foundation described it as the largest documented wave of spyware surveillance in Serbia to date, with the findings emerging in August after several targets received Apple threat notifications.
The case is part of a broader surveillance wave that has targeted at least 14 students, activists and opposition politicians since the beginning of 2026. … The SHARE Foundation says at least 14 people associated with Serbia’s student movement, civil society and political opposition have been targeted with advanced spyware since early 2026, describing it as the country’s largest documented surveillance wave to date.
Student of the Faculty of Political Sciences Ela Zeković stated yesterday that 14 students, members of the movement's operational teams, were spied on with advanced spyware and that it all started when Apple sent a notification to users that they were, as she claims, targets of an attack. And the co-president of the Green-Left Front, Radomir Lazović, claims that in the previous period, at least since the beginning of the year, he was wiretapped along with 13 other students and activists, announcing that the ZLF will address international organizations because of this.
At least 14 people across Serbia's civil society were targeted with advanced spyware ahead of local elections in March, the digital rights group SHARE Foundation said on Wednesday. … The wave of spyware infections, discovered in August after Apple (AAPL.O), opens new tab notified people in 110 countries that they had likely been victims of mercenary spyware, marks the largest documented wave of such infection in Serbia to date, the SHARE Foundation said in a statement.
Students and opposition activists targeted with spyware in Serbia
The attack closely matches the form of attack that we previously documented in a report, “A Digital Prison”: Surveillance and the suppression of civil society in Serbia, published in December 2024.
Continue your research
Verify a related claim next.
Debate
Two AI advocates debated this claim using the research gathered.
Argument for
This claim is corroborated by an overwhelming, independent convergence of at least 29 sources—including Reuters (Source 29), the Guardian (Source 5), the Financial Times (Source 30), CyberScoop (Source 11), Citizen Lab (Source 1), and the primary investigator SHARE Foundation itself (Source 17)—all confirming that at least 14 students, activists, and opposition politicians in Serbia were targeted with advanced spyware (Pegasus and NoviSpy) beginning in 2026, explicitly described as the country's 'largest documented wave of such surveillance' to date. The consistency of this figure and characterization across forensic experts, digital rights organizations, and top-tier international media, corroborated even by domestic outlets like Beta, N1, and RT Balkan reporting named victims such as MP-level officials and student movement leaders, makes the claim's factual accuracy virtually indisputable, notwithstanding the Serbian government's self-interested denials noted in Source 8 and Source 28.
The Proponent mistakes repeated reporting of SHARE Foundation's single finding for independent corroboration: Reuters, the Guardian, and other outlets expressly attribute both the count and the “largest documented wave” characterization to SHARE, while Citizen Lab independently forensically confirms an infection of one activist rather than all 14 cases (Sources 1, 4, 5, 17, 29). The Proponent also ignores the timeline contradiction: Citizen Lab found high-confidence infection indicators in December 2025, and forensic reporting describes the broader campaign as operating “since December,” so “beginning in 2026” cannot be treated as established fact (Sources 12, 16).
Argument against
The claim overstates uncorroborated allegations from SHARE Foundation as an established national fact: the repeated “14” and “largest documented wave” formulations trace to SHARE's own statement rather than an independent determination (Sources 4, 17, 29). Its asserted 2026 start is also contradicted by forensic reporting that places spyware indicators in December 2025 and describes the broader targeting as occurring “since December,” so the motion's timeline is inaccurate (Sources 12, 16).
The Opponent's 'single-source' framing commits a genetic fallacy: SHARE's forensic findings were independently corroborated by Citizen Lab's own technical analysis (Source 1) and republished without contradiction by Reuters, the Guardian, FT, and two dozen other outlets across multiple languages, satisfying journalistic independent-verification standards regardless of who first identified the pattern. On timing, the Opponent conflates one individual's forensic infection window (December 2025-January 2026, Source 16) with the documented wave's overall scope, which Sources 4, 5, 8, 13, and 17 consistently anchor to 'since the beginning of 2026' or 'ahead of the March elections'—a single early outlier does not overturn the near-unanimous dating across 20+ independent reports.
Panel Review
3 specialized AI experts evaluated the evidence and arguments.
Reviewer 1 — The Logic Examiner
Multiple independent reports (Sources 1, 2, 4, 5, 8, 13, 17, 29) converge on SHARE Foundation's forensic documentation of at least 14 students, activists, and opposition politicians targeted with advanced spyware (Pegasus/NoviSpy), explicitly framed as Serbia's largest documented wave, with Citizen Lab confirming infection indicators for at least one case; the bulk of targeting is dated to early 2026 ahead of March elections. The claim follows directly from this evidence with only a minor timeline nuance (isolated Dec 2025 indicators in Sources 12/16) that does not break the overall logical support, rendering the claim true.
Reviewer 2 — The Source Auditor
Highly reliable sources, including Reuters (Source 29), BBC (Source 2), and Citizen Lab (Source 1), confirm that at least 14 Serbian activists, students, and politicians were targeted by advanced spyware in what researchers identified as the country's largest documented surveillance wave. Although one forensic analysis noted a specific infection beginning in late December 2025 (Source 16), the overwhelming consensus of independent reporting places the broader wave's onset in early 2026, fully supporting the claim.
Reviewer 3 — The Precision Analyst
Multiple contemporaneous sources, including SHARE Foundation and BBC, directly support that at least 14 people including students, activists, and opposition politicians were targeted from the beginning of 2026 and describe it as Serbia's largest documented surveillance wave (Sources 2, 8, 17). However, forensic reporting identifies infection indicators for one case in December 2025 and describes targeting "since December," creating a limited timing ambiguity (Sources 12, 16).
Panel summary
Strong reporting from Reuters, BBC, Citizen Lab, and Serbian digital-rights researchers supports the reported total, affected groups, spyware sophistication, and characterization as Serbia's largest documented spyware-surveillance wave. The conclusion follows directly from forensic findings and convergent reporting, although many articles rely on the same underlying SHARE Foundation investigation. Precision analysis identifies only a narrow timing issue: at least one documented infection window began in December 2025, while the broader wave was reported from early 2026. This does not materially alter the claim's central meaning, so it warrants a warning rather than a downgrade.