42
57
42
57
42
42
42
42
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone
Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.
The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.
72
42
57
57
42
47
Pegasus and NoviSpy Used Against Serbian Protesters
Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.
The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.
76
42
42
42
47
57
42
57
57
42
57
42
42
57
47
47
The Smishing Deluge: China-Based Campaign Flooding Global Text Messages
Unit 42 attributes a global smishing campaign with 194,000+ phishing domains impersonating tolls, banks, and couriers to the Smishing Triad.
Palo Alto Unit 42 attributes ongoing smishing texts about toll violations and package misdelivery to the Smishing Triad, targeting U.S. residents since April 2024. Researchers identified 194,345 FQDNs across 136,933 root domains registered since January 2024, mostly via Hong Kong registrar Dominet (HK) Limited with Chinese nameservers and hosting concentrated on U.S. cloud services. The decentralized campaign impersonates banking, cryptocurrency, e-commerce, healthcare, law enforcement, and social media services, and its scale points to a large phishing-as-a-service operation. Phishing pages harvest national ID numbers such as Social Security numbers, home addresses, payment details, and login credentials.
72
42
42
57
42
57
42
42
60
42