A member of the Serbian student movement had their iPhone infected with the Pegasus spyware through a zero-click exploit delivered via iMessage, requiring no clicks on links or file openings. The compromise was verified by Citizen Lab working with the SHARE Foundation, with indicators of compromise detected between December 2025 and January 2026.
The target subsequently received an official notification from Apple warning of a possible mercenary spyware attack attempt. Researchers determined that the exploit leveraged iMessage to install Pegasus silently, granting operators access to photos, notes, messages, files, and other stored data on the device.
The spyware could also secretly activate the microphone and camera, significantly expanding surveillance capabilities against individuals of interest. The exploited vulnerability was patched by Apple starting with iOS 18.4.1, released on April 16, 2025, which addressed security flaws used in highly sophisticated attacks against specific targets.
This case is part of an intensified surveillance campaign in Serbia. At least 14 people, including students, activists, a parliament member, and a local political representative, received Apple alerts regarding potential mercenary spyware attacks. Other members of the movement were also targeted with Android spyware variants, including those related to NoviSpy.
Investigations indicate a broader escalation of operations against Serbian civil society members.
