Pegasus in Serbia Again: Activist's iPhone Infected via Zero-Click in iMessage

Researchers at Citizen Lab, working together with the Serbian organization SHARE Foundation, have confirmed that the smartphone of a member of the student protest movement was infected with the Pegasus spyware made by NSO Group. According to their findings, the attack used a so-called zero-click exploit in iMessage — the infection happens without any action on the victim's part, requiring nothing more than the message being delivered.

The analysis revealed signs that the device had been compromised between December 2025 and January 2026, though the researchers do not rule out other infections. The vulnerability the attack exploited was patched by Apple in April 2025 with the release of iOS 18.4.1.

A Wave of Surveillance Ahead of the Election

The investigation was prompted by a fresh round of warnings from Apple: the company notified users in 110 countries about possible commercial spyware attacks. By the SHARE Foundation's count, since the start of 2026 at least 14 people in Serbia have been targeted by advanced surveillance tools — members of the student movement, activists, a member of parliament, and a local opposition councilor. Chronologically, these incidents coincided with the local elections held on March 29, 2026.

A separate story involves Android. Another member of the movement had their phone infected with a new version of the NoviSpy spyware — after the device had already been seized during a police interrogation. According to Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, SHARE's forensics prove that Serbian students continue to be infected with invasive Android tools right during detention. The new sample is functionally similar to NoviSpy but was written from scratch, with clear efforts to evade detection by specialists.

Private Messages — Live on Air

The same strain was also found on a second device. A telling detail: private conversations from this phone on Viber were read out live on the pro-government TV channel Informer TV. All of this is yet another episode in a series of documented abuses of surveillance tools in the country, including the use of Cellebrite forensic tools to install NoviSpy.

What the Experts Recommend

People in at-risk groups are advised to keep their devices updated and to consider enabling Lockdown Mode on iOS. For Android, Google's Advanced Protection Program offers comparable protection. Meta, for its part, has added a strict account settings feature to WhatsApp that automatically switches a number of options to the most restrictive mode and blocks attachments from people outside your contacts list.

Source: The Hacker News