Full Report
The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware, according to new findings from the Citizen Lab in collaboration with the SHARE Foundation. "Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group's Pegasus spyware," the Citizen Lab said. "We found high-confidence indicators of
Analysis Summary
# Morning News Roll-up September 03, 2026
## Overview
Recent forensic investigations have uncovered a targeted surveillance campaign in Serbia utilizing NSO Group's Pegasus spyware and a new variant of NoviSpy. The campaign primarily targets student activists and opposition politicians, leveraging both sophisticated zero-click iMessage exploits and physical device confiscation to deploy the malware.
## Top Stories
### Pegasus Zero-Click Spyware Infects Serbian Activists
- Summary: Citizen Lab and the SHARE Foundation confirmed that a member of Serbia’s student protest movement was infected with Pegasus spyware via a zero-click iMessage exploit. The infection occurred between December 2025 and January 2026, coinciding with a broader wave of state-aligned digital surveillance targeting at least 14 individuals, including members of parliament and local councilors, leading up to the March 2026 local elections.
- Source: hxxps://thehackernews[.]com/2026/09/pegasus-zero-click-spyware-exploit[.]html
### New NoviSpy Variant Deployed via Physical Access
- Summary: Forensic analysis by Amnesty International and SHARE Foundation revealed that Serbian authorities are using confiscated devices to manually install a new version of NoviSpy Android spyware. This variant features enhanced detection evasion capabilities. In one instance, private Viber messages from a compromised device were leaked on a pro-government television channel (Informer TV).
- Source: hxxps://sharefoundation[.]info/en/share-foundation-students-and-opposition-politicians-targeted-by-spyware/
### Apple Issues Global Mercenary Spyware Threat Notifications
- Summary: Apple has dispatched a new round of threat notifications to users in 110 countries suspected of being targeted by mercenary spyware attacks. This follows the disclosure of zero-day vulnerabilities in iMessage that were addressed in iOS 18.4.1, which served as the primary entry point for recent Pegasus infections.
- Source: hxxps://thehackernews[.]com/2026/08/apple-warns-users-in-110-countries-they[.]html
***
# Pegasus and NoviSpy Campaign (Serbia 2026)
A targeted surveillance operation against Serbian civil society, student movements, and political opposition utilizing a combination of high-end remote exploits and physical device compromise.
## Key Points
- **Zero-Click Exploitation:** Pegasus was deployed via an iMessage zero-click exploit that required no user interaction.
- **Physical Infection Vector:** NoviSpy spyware was installed on Android devices while they were in the physical custody of Serbian authorities during questioning.
- **Media Weaponization:** Data exfiltrated from infected devices (Viber messages) was used for public character assassination on pro-government media outlets.
- **Widespread Targeting:** At least 14 high-profile individuals in Serbia were identified as targets during the 2026 election cycle.
## Threat Actors
- **NSO Group:** Developer of the Pegasus spyware used in the remote attacks.
- **Serbian Authorities:** Implicated in the physical confiscation of devices and subsequent installation of NoviSpy.
- **Attribution:** While NSO Group provides the tool, the deployment is attributed to state-aligned actors in Serbia targeting political dissidents.
## TTPs
- **Zero-Click iMessage Exploit:** Remote delivery of Pegasus without requiring the victim to click a link.
- **Physical Device Access:** Manual installation of spyware (NoviSpy) following legal or extralegal confiscation of hardware.
- **Forensic Tool Misuse:** Utilization of Cellebrite forensic tools to facilitate the deployment of malware on seized devices.
- **Evasion Techniques:** The new NoviSpy variant includes specific code modifications designed to bypass security expert analysis and automated detection.
## Affected Systems
- **iOS Devices:** Specifically iPhones running versions prior to iOS 18.4.1.
- **Android Devices:** Various models targeted for physical installation of NoviSpy variants.
- **Communication Apps:** iMessage (as an exploit vector) and Viber (as a source for data exfiltration).
## Mitigations
- **Software Updates:** Update iOS devices to version 18.4.1 or later to patch the iMessage zero-click vulnerability.
- **Lockdown Mode:** High-risk individuals should enable **Lockdown Mode** on iOS to reduce the attack surface for zero-click exploits.
- **Advanced Protection:** Android users should enroll in Google’s **Advanced Protection Program**.
- **Strict Account Settings:** Enable WhatsApp's "Strict Account Settings" to block attachments and media from unknown contacts.
- **Physical Security:** Avoid leaving devices unattended and use strong encryption/passcodes to hinder forensic extraction if the device is seized.
## Conclusion
The use of Pegasus and NoviSpy in Serbia represents a sophisticated dual-threat model where targets face both remote zero-day exploits and physical malware implantation. The assessment indicates that state-sponsored surveillance is being actively used to influence local political outcomes. Organizations and high-risk individuals must prioritize rapid patching and the use of hardened OS modes (like Lockdown Mode) to mitigate these highly targeted mercenary threats.