Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone
Citizen Lab and SHARE Foundation confirm a Serbian student activist's iPhone was infected with NSO Group Pegasus via a zero-click iMessage exploit.
Forensic analysis found high-confidence infection indicators on the activist's iPhone during December 2025 and January 2026, using an iMessage zero-click exploit the Citizen Lab believes was patched as of iOS 18.4.1, released April 2025. The target was among at least 14 Apple Threat Notification recipients in Serbia's student movement, civil society, and opposition politics documented by the SHARE Foundation. Targeting occurred ahead of key 2026 election cycles; Amnesty Tech also confirmed a new NoviSpy version on another student movement member's device.
- Zero-click iMessage exploit gives attackers total device access with no user interaction
- At least 14 Apple Threat Notifications documented across Serbian civil society and politics
- Citizen Lab treats notifications as presumptive infection and urges screening and Lockdown Mode
- Serbia previously linked to Cellebrite forensic tools used to plant NoviSpy spyware
- Vendors
- NSO GroupAppleCellebrite
- Products
- PegasusNoviSpyiPhoneiOS 18.4.1
- Threat actors
- NSO Group
- Victims
- Serbian student movement
- Organizations
- Citizen LabSHARE FoundationAmnesty TechAccess Now
- Countries
- Serbia
From the original article
2 min read at infosecurity-magazine.com
Pegasus infected a Serbian student activist's iPhone through an iMessage zero-click exploit
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.