Pegasus and NoviSpy Used Against Serbian Protesters
Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.
The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.
- Zero-click Pegasus infection via iMessage exploit required no victim interaction
- Pegasus grants full device access to messages, photos, microphone and camera
- Apple patched the iMessage exploit in iOS 18.4.1
- SHARE calls it the largest documented surveillance wave in Serbia's history
- Targets advised to enable Lockdown Mode and treat Apple Threat Notifications as presumed infections
- ATT&CK
- T1203 Exploitation for Client ExecutionT1005 Data from Local SystemT1123 Audio CaptureT1113 Screen Capture
- Vendors
- AppleNSO GroupCellebrite
- Threat actors
- NSO Group
- Countries
- Serbia
From the original article
3 min read at securityaffairs.com
Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections. A member of Serbia’s student protest movement had their iPhone infected with NSO Group ‘s Pegasus spyware without ever clicking a link or opening a file.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.