Pegasus and NoviSpy Used Against Serbian Protesters
Brief
Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections.
A member of Serbia’s student protest movement had their iPhone infected with NSO Group ‘s Pegasus spyware without ever clicking a link or opening a file.
The Citizen Lab confirmed the infection in collaboration with the SHARE Foundation, tracing it to an iMessage zero-click exploit and identifying high-confidence indicators of compromise between December 2025 and January 2026, with the possibility of additional infections not ruled out.
“In collaboration with the SHARE Foundation , the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware.” reads the report published by Citizen Lab.