Pegasus and new NoviSpy variant found on Serbian activists' phones; 29 MEPs urge slowing Serbia's EU accession over spyware

The Citizen Lab confirmed the first forensically confirmed Pegasus infection of 2026 — a zero-click iMessage hack of a Serbian student activist's iPhone, with high-confidence indicators from December 2025 to January 2026 and an exploit patched in iOS 18.4.1…

The Citizen Lab, working with the SHARE Foundation, confirmed with high probability/high confidence the first forensically confirmed Pegasus infection of 2026: a member of Serbia's student protest movement had their iPhone infected with NSO Group's Pegasus spyware via a zero-click iMessage exploit requiring no user interaction and granting full device access, with high-confidence infection indicators from December 2025 to January 2026. The Citizen Lab believes the exploit was patched as of iOS 18.4.1, released in April 2025, and updated iOS versions break the exploit chain. The SHARE Foundation documented at least 14 targets in Serbia since the start of 2026 — across the student movement, civil society, and opposition politics, including student activists, a member of parliament, and a local councilor/government official — the largest documented spyware wave in the country to date, timed ahead of key local and parliamentary elections, including local elections on March 29, 2026. (Infosecurity characterized the 14 as Apple Threat Notification recipients documented by SHARE; the Citizen Lab treats notifications as presumptive infections and urges forensic screening and Lockdown Mode.) Amnesty International confirmed a new NoviSpy variant on activists' devices — sources differ on details: CyberScoop reports two infected devices; The Hacker News describes a new NoviSpy-like Android spyware found on a confiscated phone; Infosecurity reports Amnesty Tech confirming a new NoviSpy version on another student movement member's device. NoviSpy infections followed police questioning and detention and the disclosure of private messages by a loyalist outlet; evidence points to Serbian police or intelligence services (CyberScoop's later report: Serbian government authorities), though Pegasus attribution has not been assigned. Serbia was previously linked to Cellebrite forensic tools used to plant NoviSpy (Infosecurity). Apple mercenary spyware threat notifications preceded the findings and were sent to users in 110 countries (The Hacker News). WIRED's September 5, 2026 security roundup independently cited the Citizen Lab's finding that 14 Serbian civil society members were targeted with mercenary spyware, including at least one Pegasus infection. In response, 29 Members of the European Parliament sent a letter on Friday (September 4, 2026) demanding Serbia's EU accession be slowed until an investigation into its spyware use is completed, urging European Commission…

• Citizen Lab, with the SHARE Foundation, confirmed with high probability/high confidence the first forensically confirmed Pegasus infection of 2026: NSO Group's Pegasus on a Serbian student protest movement member's iPhone via a zero-click…
• High-confidence infection indicators span December 2025 to January 2026
• The Citizen Lab believes the exploit was patched as of iOS 18.4.1, released in April 2025; updated iOS versions break the exploit chain
• The SHARE Foundation documented at least 14 targets in Serbia since the start of 2026 — student activists, a member of parliament, and a local councilor/government official — the largest documented spyware wave in Serbia to date
• Targeting coincided with key local and parliamentary elections, including local elections on March 29, 2026
• Infosecurity characterized the 14 as Apple Threat Notification recipients documented by SHARE; the Citizen Lab treats notifications as presumptive infections and urges forensic screening and Lockdown Mode
• NoviSpy confirmation details differ by source: CyberScoop reports Amnesty International confirmed two devices with a new NoviSpy variant; The Hacker News describes a new NoviSpy-like Android spyware found on a confiscated phone;…
• NoviSpy infections followed police questioning and detention and the disclosure of private messages by a loyalist outlet