At least 14 people in Serbia were targeted with Pegasus spyware during local elections in early 2026, marking the country’s largest documented surveillance wave to date.
The targets included student movement members, activists, an opposition member of Serbia’s parliament and a local opposition councillor. Investigators said attackers used an iMessage zero-click exploit to infect victims’ phones without requiring any action from them.
Citizen Lab and Amnesty International’s Security Lab independently confirmed Pegasus spyware infections on the affected devices.
Apple threat alerts prompted investigation
In August, 12 people contacted the SHARE Foundation after receiving Apple threat notifications warning that their iPhones may have been targeted by spyware.
Subsequent forensic analysis confirmed two further infections. The victims included people connected to student movements and opposition political groups.
Researchers said the attackers used an iMessage zero-click vulnerability to install surveillance software remotely. Victims did not need to open a message, click a link or interact with malicious content.
This makes Pegasus spyware particularly difficult to detect and defend against.
Pegasus can monitor an entire smartphone
Pegasus is spyware developed by the Israeli company NSO Group. Once installed, it can give an operator extensive access to a compromised smartphone.
The malware can intercept communications, including emails, text messages and WhatsApp conversations. It can also collect contacts, photos and videos, record calls and secretly activate a device’s microphone or camera.
In addition, Pegasus can track a victim’s location. These capabilities allow attackers to monitor targets around the clock while remaining largely hidden.
Exploit was patched in 2025
Apple fixed the vulnerability used in the attack in iOS 18.4.1, released in April 2025. The Serbian cases show that devices which do not receive security updates can remain exposed to known spyware exploits.
The SHARE Foundation urged users to keep their smartphones fully updated, avoid content from unknown sources and ignore suspicious links. Although zero-click attacks do not require interaction, general security habits still reduce exposure to other threats.
Higher-risk users should enable extra protections
Journalists, human rights activists, academics and politicians face a higher risk of targeted spyware campaigns, particularly in authoritarian environments.
Security researchers recommend that iPhone users in these groups enable Apple’s Lockdown Mode. Android users can turn on Advanced Protection for stronger safeguards against sophisticated attacks.
The Pegasus spyware Serbia cases highlight the continued risk posed by commercial surveillance tools. Zero-click exploits can compromise devices silently, which makes timely updates and advanced device protections essential.
0 responses to “Pegasus Spyware Hits Serbian Students and Politicians in Zero-Click Attack”