A member of Serbia's student protest movement has been infected with NSO Group's Pegasus spyware through an iMessage zero-click exploit, according to a forensic investigation by the Citizen Lab and the SHARE Foundation.
The Citizen Lab said it found high-confidence indicators of infection on the individual's iPhone across December 2025 and January 2026, but that this did not rule out further infections. The target consented to publication but asked to remain unnamed, and the exact infection date was withheld to protect their privacy.
The September 2 research said the attack used an iMessage zero-click exploit that the Citizen Lab believed had been patched by Apple as of iOS 18.4.1, a version Apple released in April 2025.
A zero-click exploit requires no action from the recipient, allowing spyware to be delivered without the target clicking a link or opening an attachment.
The researchers said such an infection would not have been visible to the target and would give the attacker total access to the device, including notes, pictures and encrypted messages, and the ability to covertly activate the microphone and camera.
Pegasus Targets Serbian Student Movement
The laboratory said the investigation began after the individual received an Apple Threat Notification warning of targeting with mercenary spyware.
The notification was among at least 14 documented by the SHARE Foundation involving members of Serbia's student movement and civil society, as well as an opposition member of parliament. The Citizen Lab said the targeting came ahead of key 2026 election cycles.
The Toronto-based laboratory said the case formed part of a longer history of surveillance abuses in Serbia, including previous Pegasus targeting of civil society and the use of Cellebrite forensic tools to plant NoviSpy spyware.
The SHARE Foundation and Amnesty Tech confirmed the same day that a new version of NoviSpy had been found on another student movement member's device.
Read more on commercial spyware: NSO Group Hit with $168m Fine for WhatsApp Pegasus Spyware Abuse
What Notification Recipients Should Do
The Citizen Lab said an Apple Threat Notification should be treated as presuming infection, and urged recipients to seek expert assistance immediately.
It also recommended that close contacts such as family members and collaborators seek spyware screening, that people at heightened risk enable Apple's Lockdown Mode, and that all devices be kept updated.
Individuals in Serbia were encouraged to contact the SHARE Foundation, while recipients elsewhere were directed to trusted experts such as Access Now's Digital Security Helpline. It said there was no substitute for personalized advice but pointed to online resources including Security Planner.
The laboratory said its forensic work on the other notification cases was continuing, and that the confirmation demonstrated continued targeting of Serbia's pro-democracy movement with mercenary spyware.
Image credits: Tada Images / Poetra.RH / Shutterstock.com