Serbia Developed Its Own Spyware — And Used It on Journalists

Beyond deploying commercial surveillance tools, Serbian authorities have built spyware of their own. Amnesty International's December 2024 investigation, "A Digital Prison," documented the systematic use of NSO Group's Pegasus spyware alongside a newly discovered, domestically-developed Android spyware system called NoviSpy, designed to infect devices and capture confidential information — including full contact lists — which was then uploaded to a government-controlled server. This wasn't an imported tool being misused; it was purpose-built surveillance technology created specifically to monitor Serbian citizens.

Journalists Are Still Being Targeted Months After the Scandal Broke

Rather than stopping after public exposure, the surveillance campaign has continued. Amnesty International confirmed in March 2025 that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus spyware in February 2025 — evidence that came after Amnesty had already written to Serbia's Security Information Agency twice seeking a response, without ever receiving one. Legal experts have noted that Serbian law provides no legal basis for the intelligence agency's use of spyware at all, meaning this surveillance operates entirely outside any documented legal authorization.

Forensic Phone-Extraction Tools Were Also Being Misused

Beyond spyware installed remotely, Serbian authorities have used physical device-extraction technology against civil society as well. The same investigation revealed that mobile forensic products made by the Israeli company Cellebrite — technology Serbia received in 2019 as part of its EU integration efforts — were being used to extract data directly from the phones of journalists and activists. In response to the findings, Cellebrite announced in February 2025 that it would stop providing its products to the relevant customers in Serbia, a rare instance of a surveillance vendor cutting off a government client following public exposure.

Targeting Has Coincided With a Period of Sustained Civil Unrest

This surveillance activity has occurred against the backdrop of widespread student protests that have gripped Serbia since November 2024, with journalists and activists connected to that movement facing continued digital targeting. One journalist working on a story involving foreign investments and corruption cases received a Pegasus infection attempt disguised as a personal message, shortly after meeting with sources close to the government for her reporting.

What This Means in Practice

Given the documented, ongoing use of both commercial and domestically-built spyware against journalists and civil society in Serbia, general privacy advice has real limits here — a VPN protects network traffic, but not a device that's already been compromised by spyware designed to extract data directly from the phone itself. For ordinary personal data protection — securing your traffic on public Wi-Fi, limiting exposure to commercial trackers — a VPN with a verified no-logs policy and strong encryption remains a reasonable baseline measure, and keeping your device's operating system updated matters, since spyware has historically relied on exploiting unpatched vulnerabilities. But if you are a journalist, activist, or otherwise connected to Serbia's civil society and facing elevated personal risk, this is not a situation general advice can adequately address — organizations like Amnesty International's Security Lab and Access Now's Digital Security Helpline can check your specific device for signs of compromise and offer guidance suited to genuinely high-risk circumstances.

VPNs Are Legal — But the Surveillance Climate Is a Real Concern

VPNs are legal in most countries, including Serbia, where the technology is treated as a standard privacy and security tool. Serbia still features only limited website blocking and strong constitutional protections for journalists. But the surveillance environment has deteriorated sharply: internet freedom in Serbia declined during the past reporting period as the government cracked down on widespread student protests that began after the September 2024 Novi Sad train station tragedy, with authorities detaining social media users over protest-related content.

Why Serbians Are Genuinely Worried About Privacy

The scale of surveillance documented here is significant. A December 2024 Amnesty International report revealed that Serbian authorities routinely used NoviSpy — a spyware tool installed on victims' devices while in police detention — alongside Cellebrite data extraction technology, to access sensitive information from journalists and activists. In March 2025, Amnesty International separately confirmed that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus spyware, sent via a Viber message disguised as a routine news tip. Between January and May 2025 alone, Serbia's Independent Journalists Association reported 15 physical attacks against journalists, including those reporting online.

What to Look For in a UCN VPN for Serbia

Given this documented surveillance activity, a verified no-logs policy matters considerably more here than in most countries. Look for a UCN VPN with WireGuard® encryption and an independently audited no-logs policy from a provider with no operational presence inside Serbia — since Serbian authorities have shown a documented willingness to use invasive tools against journalists, activists, and ordinary protest participants alike.

What "No-Logs" Actually Means — And Its Real Limits Here

A no-logs policy means the VPN provider stores no record of your browsing activity, IP address, or connection times — so there's nothing to hand over under any pressure. It's important to be honest about limits, though: a VPN protects your traffic in transit, but device-level spyware like Pegasus or NoviSpy can bypass VPN encryption entirely once installed on a device. A UCN VPN is one meaningful layer of protection among several — keep devices updated with the latest security patches as a first, equally important step.

Getting Started in Under a Minute

Download the UCN VPN app, sign in, and tap Connect — your traffic is encrypted immediately. For everyday privacy — banking, browsing, and streaming — this is a simple, low-risk habit; for anyone involved in journalism, activism, or protest organizing in Serbia right now, treat digital security as a broader practice, not a single tool.

Serbia's VPN use remains fully legal, but its documented surveillance record makes genuine privacy tools more than a convenience — a UCN VPN is one meaningful part of a much broader picture right now.