As reported by The Hacker News, Citizen Lab and the SHARE Foundation have confirmed that a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware via an iMessage zero-click exploit. The infection window spans December 2025 through January 2026 — and the exploit chain was reportedly addressed by Apple in iOS 18.4.1, released April 2025. That temporal gap carries significant defensive implications.
The Patching Gap Is the Exploit
The most operationally significant detail in this report is not the spyware itself — it is the timeline. If the zero-click vector was addressed in April 2025 and the infection occurred in December 2025, the target's device was running outdated iOS for at least eight months. For mercenary spyware operators, unpatched devices belonging to high-value civil society targets represent a persistent opportunity window that closes only when the user updates — and many users, particularly activists in restrictive environments, delay updates due to bandwidth constraints, device compatibility concerns, or simple awareness gaps.
The exploit doesn't need to be a zero-day if the target never installs the patch. Time-to-patch for mobile devices in at-risk populations remains the single largest controllable risk factor in mercenary spyware campaigns.
A Multi-Vector Surveillance Architecture
This case is notable not for a single technique but for the convergence of multiple attack vectors deployed against a coordinated target set. At least 14 individuals in Serbia — students, activists, opposition politicians — were targeted since January 2026, timed around the March 29 local elections. The toolkit included:
This is not opportunistic surveillance. It is an integrated intelligence collection and influence apparatus where digital espionage feeds directly into media campaigns designed to discredit opposition figures.
The NoviSpy Evolution
Particularly concerning is the identification of a new Android spyware strain bearing functional similarity to NoviSpy but rebuilt with specific anti-detection measures. This indicates active development cycles responding to public forensic research — threat actors are reading Citizen Lab and Amnesty reports and adapting. Defenders should expect future variants to incorporate increasingly sophisticated anti-analysis techniques, making mobile forensic detection a moving target.
Vulnerability Context
| Detail | Information |
|---|---|
| Exploit Type | iMessage zero-click |
| Delivered Payload | NSO Group Pegasus |
| Patched In | iOS 18.4.1 (April 2025) |
| CVE Identifier | Not specified in source reporting |
| Active Exploitation | Confirmed Dec 2025 – Jan 2026 |
| Affected Platform | iOS (iPhone); separate Android spyware (NoviSpy variant) |
| Apple Threat Notifications | Issued to users across 110 countries |
Who Is at Risk
The targeting pattern is clear: civil society actors, opposition political figures, student organizers, and journalists operating in environments where state or state-aligned actors have both the motivation and the access to deploy mercenary surveillance tools. However, the risk extends beyond Serbia. Apple's threat notifications reached users in 110 countries — the global footprint of mercenary spyware customers is far broader than any single country's domestic politics.
Shield53 Recommendations
Immediate Actions for High-Risk Users
- Update iOS immediately to the latest available version. If you are running anything below iOS 18.4.1, consider the device potentially compromised and perform a clean restore.
- Enable Lockdown Mode on iOS (Settings → Privacy & Security → Lockdown Mode). This significantly reduces the attack surface for zero-click exploitation by disabling preview rendering in iMessage and limiting other attack vectors.
- Enroll in Apple's threat notifications and ensure the associated Apple ID contact information is current and monitored.
- Android users should enroll in Google's Advanced Protection Program and avoid handing devices to third parties without powering off first. Bootloader-locked, encrypted devices are significantly harder to compromise via physical access tools like Cellebrite.
- Assume physical seizure equals compromise. If your device has been confiscated by any authority, treat it as fully compromised upon return. Forensic imaging and device replacement are the only reliable remediation paths.
For Security Teams Supporting At-Risk Populations
- Deploy MDM policies enforcing automatic OS updates for high-risk users where feasible.
- Conduct regular mobile forensic checks using tools like MVT (Mobile Verification Toolkit) developed by Amnesty International's Security Lab.
- Brief at-risk users on the physical access threat model — power off devices before any interaction with law enforcement, as cold boot states prevent exploitation of locked-but-powered forensic tools.
- Migrate sensitive communications to platforms with per-message encryption and device-level locking (e.g., WhatsApp's Strict Account Settings, Signal).
Broader Strategic Implications
The Serbia case demonstrates that mercenary spyware is not a counterterrorism tool — it is a domestic political control instrument. The integration of surveillance with pro-government media operations should prompt policymakers to revisit export control frameworks for dual-use surveillance technology. Until commercial spyware vendors face meaningful consequences for misuse, the market will continue to supply tools to actors who deploy them against students and activists.
