From Fehim Sali's file in Kosovo to spying on students in Serbia: How Vučić uses the BIA for espionage and political interference

The case of Fehim Sali, arrested in Kosovo on suspicion of espionage and collaboration with the Serbian Security and Intelligence Agency (BIA), has taken on a new dimension after the publication of an audio recording in which he is heard talking to a senior official of this service about securing votes for Aleksandar Vučić and the SNS.

According to materials from the Kosovo Special Prosecution Office, Sali was recruited by the BIA and for a period of time acted under the instructions of its officials.

He was arrested on August 13 at the Merdare border crossing while crossing into Serbia. Following the arrest, Kosovo Police and the Special Prosecution Office raided his home in Dragash, where they seized phones and other materials suspected of being related to the activity under investigation.

The prosecution stated that Sali himself admitted that he was recruited and that he had constant contact with BIA officials. The Special Prosecution also describes Sali as a person recruited by the BIA, who acted under the orders and instructions of Želimir Matović, known by the nickname “Željko”.

Sali is suspected of providing the BIA with information about the political situation in Kosovo, identifying and photographing officials of the Kosovo Intelligence Agency, and collecting information on other individuals.

Among the individuals suspected of collecting data were individuals described by the Prosecution as members of Wahhabi sects. According to the prosecution's suspicions, some of them were subsequently proposed to the BIA as potential targets for contact and recruitment.

The prosecution also said that Sali had maintained contacts with politically and socially influential persons in Serbia and Kosovo, including members of non-majority communities.

In an audio recording obtained by KOHA, Sali is heard talking to Želimir Matović about the voter lists from the Gorani community in Kosovo and about people who refused to sign. The conversation discusses efforts to secure support for Serbian President Aleksandar Vučić and the Serbian Progressive Party (SNS).

Sali is heard telling the BIA official that he had also identified the people who had refused to sign.

In another part of the conversation, he is heard proposing the use of pressure and force to convince people who refused to support the SNS and Vučić. Sali also says that he had entered this activity for the SNS and Vučić and that he aimed for victory.

Sali was the founder of the NGO "Moja Gora" and, through it, is suspected of being engaged in securing votes for the SNS during the 2024 elections. The media has also published photographs showing voter lists and materials that, according to reports, are related to the collection of signatures for the SNS.

According to the same report, Sali's vote-sourcing activity did not end with the 2024 elections.

A few days before his arrest, he was allegedly again engaged in securing votes from members of the Gorani community in Kosovo for the SNS.

In part of the audio recording, he also talks about the method of transporting the materials and the concern that they could be discovered while crossing the border.

According to the Prosecution, Sali has been in custody since August 14.

His defense has not yet made a public comment on the allegations related to electoral activity and contacts with the BIA. Attorney Ahmer Alia, who is representing him, has not commented on these allegations.

Serbian authorities accused of illegal espionage

Meanwhile, new data has been published in Serbia on another issue related to the activity of the security apparatus – the use of spyware against students, activists, and opposition figures.

The SHARE Foundation announced on September 2 that at least 14 people in Serbia have been targeted with advanced spyware since the beginning of 2026.

According to the organization, this is the largest documented wave of use of such surveillance technologies in Serbia to date.

Among the targets were members of the student movement, activists, a member of parliament and a local councilor from opposition parties. SHARE has noted that the targeting period coincides with the local elections on March 29, 2026.

The case became public after 12 people approached SHARE experts in August after receiving notifications from Apple that they may have been targeted with mercenary spyware.

Two other cases were identified through forensic analysis of the devices.

Citizen Lab confirms Pegasus

One of the cases has been further verified by Citizen Lab, a research laboratory at the University of Toronto.

According to Citizen Lab, the iPhone of a member of the student movement in Serbia was infected with Pegasus, spyware developed by the Israeli company NSO Group.

Forensic analysis identified the use of a “zero-click” attack via iMessage. This means that the device can be compromised without the victim needing to click a link or perform any action.

Citizen Lab has identified high-confidence indicators for infection during the period December 2025–January 2026.

The organization stressed that this discovery does not automatically mean that all other cases were carried out with the same spyware.

In addition to Pegasus, the SHARE Foundation has also identified a new version of the NoviSpy spyware.

Amnesty International Security Lab has confirmed the SHARE Foundation's forensic findings on a device belonging to a member of the student movement.

According to the investigation, his phone was taken during police detention and spyware was later identified on the device.

NoviSpy is particularly worrisome because of its capabilities. The spyware can access device data, including communications, contacts, photos, and files, and can also enable screen recording and microphone or camera activation.

SHARE reported that a version of NoviSpy was first detected in Serbia in 2024.

In previous investigations, researchers had found that the server where data collected from an infected device was sent was connected to an IP address belonging to the BIA infrastructure. In those cases, the use of Cellebrite tools after the detention of activists and journalists was also reported.

A previously documented connection to the BIA

These developments are also important because of the documented history of the use of surveillance tools in Serbia.

The SHARE Foundation had previously reported that devices of activists, journalists, and members of civil society had been analyzed following police detentions and that in some cases advanced surveillance tools had been found.

In 2024, researchers discovered NoviSpy, a spyware that could harvest data from infected devices. Analysis at the time linked the infrastructure where the data was sent to an IP address associated with BIA. lm reported in 2026.

Similarly, Citizen Lab has confirmed the Pegasus infection of a student, but has not presented public evidence identifying the perpetrator of this attack as the BIA or any other specific institution.

The new reports have also caused reactions in the European Union.

The European Commission has stated that any illegal attempt to access the data of citizens or political rivals is unacceptable.

Brussels has said it is aware of allegations of the use of spyware against student activists and opposition figures in Serbia and that the matter should be handled in accordance with fundamental rights standards.

The European Parliament has also previously expressed concern about the use of surveillance tools, including Pegasus, Cellebrite and NoviSpy, against protesters and political opponents in Serbia.

Two cases, one common background

The Fehim Sali case and the spyware investigations in Serbia are two separate issues, and there is no public evidence directly linking them to a single operation.

In Kosovo, the Special Prosecution Office is investigating Sali on suspicion of espionage and collaboration with the BIA.

According to the prosecution's file, his activity allegedly included gathering political information, identifying intelligence officials, and securing potential targets for contact or recruitment.

The recently released audio recording adds another element: the claim that he was also engaged in securing votes for the SNS and Vučić among the Gorani community in Kosovo.

In Serbia, meanwhile, the SHARE Foundation has documented at least 14 people targeted with spyware during 2026, while Citizen Lab and Amnesty International have technically confirmed cases of infection with Pegasus and a new version of NoviSpy.

Both issues are now part of a broader debate about the use of security institutions and technologies in a tense political period in Serbia and its relations with Kosovo.

The GeoPost