Criminal Complaint Filed Over Spyware

Lawyers for student Jelena Kontić demand an investigation into unidentified officers of Serbia’s security agency and the police

Lawyers representing student Jelena Kontić have filed a criminal complaint with the Prosecutor’s Office for High-Tech Crime over the installation of Pegasus spyware on her phone. The complaint was filed against individuals within the Security Information Agency and the police whose identities have yet to be established, as well as responsible individuals at NSO Group, the Israeli company that manufactures Pegasus.

Jelena Kontić’s case is the first confirmed successful Pegasus spyware infection in Serbia, and the first worldwide this year. Her lawyers stated that the infection was confirmed by Citizen Lab at the University of Toronto and that a certified court expert in Italy had created a forensic image of the infected device.

The complaint covers five criminal offenses: unauthorized collection of personal data, unauthorized interception and recording, creation and introduction of computer viruses, unauthorized access to a protected computer, and abuse of office. All five offenses are prosecuted ex officio and are punishable by imprisonment.

Jelena learned that she had been targeted when she received a notification from Apple. A subsequent detailed forensic analysis confirmed that her device had been compromised remotely through a so-called “zero-click” attack. The attack exploited a vulnerability in the iMessage app on her iPhone, without her knowledge or any interaction on her part.

The competent prosecutor’s office is urged to launch an investigation without delay and take all steps within its remit. The lawyers also point out that all offenses covered by the complaint are prosecuted ex officio, meaning that the prosecutor’s office was required to act as soon as the case became public, given its seriousness and potential consequences for the rights and freedoms of citizens and political actors, particularly during the sensitive pre-election period.

In early September, SHARE Foundation reported that the devices of at least 14 people in Serbia had been targeted in attempts to infect them with various types of advanced spyware since the beginning of 2026. Those targeted included members of the student movement and activists, as well as Green–Left Front MP Radomir Lazović and a local councilor from an opposition party. The targeting largely coincided with the period surrounding the local elections held on March 29, 2026.

Pegasus is military-grade spyware sold exclusively to governments and government agencies. Once installed on a phone, it provides access to virtually all data on the device, including communications, contacts, photographs, app content, and other files. It also enables covert surveillance through screen recording and activation of the microphone or camera without the user’s knowledge.