A member of Serbia’s student protest movement had their iPhone infected with NSO Group’s Pegasus spyware using a zero-click exploit in Apple’s iMessage service, according to new research from the Citizen Lab in collaboration with the SHARE Foundation. The infection occurred between December 2025 and January 2026 — a period of heightened political activity in Serbia preceding the country’s local elections on March 29, 2026.
The zero-click exploit required no interaction from the victim. Pegasus was silently delivered through an iMessage and gave attackers full remote access to the device. Apple has since patched the vulnerability in iOS 18.4.1, released in April 2025. Beyond the iPhone case, the SHARE Foundation confirmed that at least 14 people in Serbia have been targeted with advanced spyware since early 2026 — including student movement members, activists, a member of parliament, and local councilors from opposition parties. A second student had NoviSpy Android spyware installed on their phone while their device was confiscated during police questioning. Researchers also identified a newly built Android spyware strain on a third device, with specific technical efforts to evade detection by security experts.