Full Report
It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia yet. The post Pegasus, NoviSpy variant spyware found on devices of Serbian activists appeared first on CyberScoop.
Analysis Summary
# Morning News Roll-up September 2, 2026
## Overview
Recent forensic investigations have uncovered a significant surge in spyware surveillance targeting Serbian civil society. The findings highlight the first confirmed Pegasus infection of 2026 and a widespread campaign involving a new variant of the NoviSpy malware, primarily targeting student activists, local government officials, and members of parliament.
## Top Stories
### Pegasus, NoviSpy variant spyware found on devices of Serbian activists
- Summary: Researchers from Citizen Lab and Amnesty International have documented the largest wave of spyware surveillance in Serbia to date. The campaign utilized NSO Group’s Pegasus via zero-click exploits and a new variant of NoviSpy. Forensic evidence suggests these tools were deployed against activists during periods of political unrest following the Novi Sad railway station tragedy, with some infections occurring while individuals were in police custody.
- Source: hxxps://cyberscoop[.]com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/
### ATF confirms cyberattack by Qilin Ransomware
- Summary: The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack targeting a system containing sensitive information regarding investigation targets. The attack has been linked to the Qilin ransomware group, marking a significant breach of law enforcement data.
- Source: hxxps://cyberscoop[.]com/atf-doj-cyberattack-qilin-ransomware/
### Two alleged TeamPCP members arrested following supply-chain chaos
- Summary: Law enforcement authorities have arrested two individuals suspected of being members of "TeamPCP." The group is allegedly responsible for months of software supply-chain attacks that disrupted multiple sectors. The arrests follow a multi-month investigation into their extortion and data theft activities.
- Source: hxxps://cyberscoop[.]com/teampcp-cybercrime-arrests-supply-chain-attacks/
---
# Pegasus and NoviSpy Surveillance Campaign (Serbia)
Primary surveillance campaign targeting Serbian activists and political figures using high-end commercial and custom spyware.
## Key Points
- First forensically confirmed Pegasus infection of 2026.
- The "biggest wave" of spyware surveillance documented in Serbia, involving 14 confirmed targets.
- Coincides with political protests regarding the Novi Sad railway station collapse and upcoming elections.
- Use of "zero-click" exploits, requiring no interaction from the victim to compromise the device.
- Discovery of a new variant of "NoviSpy" deployed against detained individuals.
## Threat Actors
- **NSO Group:** Developers of Pegasus spyware (state-sponsored clients).
- **Serbian Authorities:** Attributed by SHARE Foundation and Amnesty International as the likely operators of NoviSpy, particularly during police detentions.
## TTPs
- **Zero-Click Exploits:** Used to deliver Pegasus between December 2025 and January 2026.
- **Physical Access/Detention Deployment:** NoviSpy variants were installed or activated after authorities took possession of devices during police questioning.
- **Data Exfiltration:** Capabilities include screen recording, microphone activation, and access to encrypted private messages.
- **Media Leaks:** Exfiltrated private messages were subsequently disclosed by pro-government media outlets to discredit activists.
## Affected Systems
- **Mobile Platforms:** iOS and Android devices.
- **Victims:** Serbian student activists, one Member of Parliament, and one local government official.
- **Exploit Range:** Active Pegasus exploits identified from late 2025 through early 2026.
## Mitigations
- **Lockdown Mode:** For iOS users, enabling Lockdown Mode can mitigate many zero-click exploit vectors.
- **Device Hygiene:** Avoid leaving devices unattended or in the custody of third parties; use strong, unique passcodes.
- **Rebooting:** Regular reboots can sometimes clear non-persistent spyware from memory, though many modern variants are persistent.
- **Forensic Scanning:** Use tools like MVT (Mobile Verification Toolkit) to check for known indicators of Pegasus or NoviSpy.
## Conclusion
This campaign represents a significant escalation in the use of invasive surveillance technology for political repression in Serbia. The combination of high-cost zero-click exploits (Pegasus) and opportunistic infections during detention (NoviSpy) indicates a sophisticated, multi-layered approach by state actors to monitor and intimidate democratic opposition and civil society. Organizations and activists in the region should treat mobile devices as high-risk and implement rigorous device security protocols.