Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Summary: Citizen Lab, working with the SHARE Foundation, confirmed that an iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware via an iMessage zero-click exploit, with high-confidence indicators of infection across December 2025 to January 2026. The exploit is assessed to have been addressed by Apple in iOS 18.4.1, released in April 2025, and the SHARE Foundation confirmed at least 14 people in Serbia have been targeted with advanced spyware since the start of 2026, including student movement members, activists, a member of parliament, and an opposition local councilor, with the incidents coinciding with local elections held on March 29, 2026.
Key Takeaway: At least 14 people in Serbia were targeted with advanced spyware in a period overlapping the March 29, 2026 local elections, and a second student movement member's phone was compromised with a new NoviSpy-like Android spyware installed while detained by Serbian authorities. The same strain surfaced on another device after private Viber messages from that phone were disclosed live on the pro-government channel Informer TV.

Read the original at The Hacker News ↗