SERBIAN activists were targeted with zero-click Pegasus spyware and NoviSpy across a disclosed wave of infections that Citizen Lab and the SHARE Foundation traced to late 2025 into early 2026. An iPhone belonging to a member of Serbia’s student protest movement was infected without the user clicking a link or opening a file, via an iMessage zero-click exploit.
Citizen Lab’s analysis, conducted in collaboration with the SHARE Foundation, identified high-confidence indicators of compromise from December 2025 to January 2026, with indications that additional infections could remain undisclosed.
The infection allowed the attacker full access to the device, including messages, photos, notes, and the potential to secretly enable the microphone and camera. Apple subsequently patched the vulnerability in iOS 18.4.1.
The episode is framed as part of a broader pattern of state-linked surveillance; SHARE Foundation’s investigation documents at least 14 individuals targeted since early 2026, spanning student activists, civil society figures, and opposition politicians, described as the largest documented surveillance wave in Serbia’s history. In one related case, Amnesty International’s Security Lab and SHARE found NoviSpy, an Android variant, on an activist’s phone after Serbian authorities seized it during police questioning.
The piece notes the timing aligns with Serbia’s local elections in March 2026 and planned parliamentary elections in October. Guidance from Citizen Lab and rights groups emphasises treating Apple Threat Notifications as indicators of likely infection and seeking expert assistance promptly. Advocates urge updates and use of lockdown features to mitigate risk.