Pegasus Spyware Hit a Serbian Student Activist's iPhone Through a Silent iMessage Attack
Citizen Lab says a zero-click exploit planted NSO Group's Pegasus on the phone of a member of Serbia's student protest movement, with no tap or click required.
Key points
- Citizen Lab and the SHARE Foundation confirmed Pegasus spyware on the iPhone of a Serbian student protest movement member.
- The infection used an iMessage zero-click exploit: the victim never had to open a link or interact with the message at all.
- Pegasus is made by Israel's NSO Group, which sells only to government customers.
- Researchers found high-confidence indicators of the Pegasus toolkit on the device.
- The case extends a pattern of Pegasus use against activists and journalists in Serbia.
A member of Serbia's student protest movement had their iPhone secretly infected with Pegasus, the government-grade spyware made by Israel's NSO Group, according to new findings from the Citizen Lab working with Belgrade digital rights group the SHARE Foundation.
The attack used what researchers call a zero-click exploit. The victim didn't have to tap anything. A booby-trapped iMessage arrived, and the phone was compromised in the background.
"Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group's Pegasus spyware," Citizen Lab wrote, adding that researchers found high-confidence indicators of the Pegasus toolkit on the device. The Hacker News first reported the case.
What is Pegasus, in plain English?
Pegasus is spyware sold by NSO Group to government agencies. Once installed, it can read messages, listen to calls, activate the microphone and camera, and pull location data, leaving almost no trace a normal user could spot.
NSO says it sells only to vetted state customers for serious crime and counter-terrorism work. Human rights groups have documented repeated cases where the tool has landed on the phones of journalists and opposition figures. We covered one of the starker examples on 3 July 2026, when forensic analysis confirmed Pegasus had repeatedly infected an EU lawmaker's phone while he sat on the European Parliament's own spyware inquiry.
Who was targeted?
The victim is a member of the student-led protest movement that has driven mass demonstrations across Serbia. Citizen Lab didn't name the individual. The infection is the latest in a run of Pegasus cases tied to Serbian civil society.
| Detail | What we know |
|---|---|
| Victim | Member of Serbia's student protest movement |
| Spyware | Pegasus, made by NSO Group |
| Delivery | Zero-click exploit over iMessage |
| Device | iPhone |
| Investigators | Citizen Lab and SHARE Foundation |
How does a zero-click attack even work?
A zero-click attack abuses a bug in software that processes incoming data automatically. On an iPhone, iMessage previews content the moment it arrives: images, attachments, link previews. Find a flaw in that processing code and you can craft a message that quietly runs your own code on the target's phone the second it lands.
Nothing to click. No warning at all.
Apple has patched several of these bugs in emergency updates and has also rolled out Lockdown Mode, a stripped-back setting that disables many of the features Pegasus-style attacks rely on.
Who is investigating, and what happens next?
Citizen Lab, based at the University of Toronto, has repeatedly caught Pegasus in the wild. The SHARE Foundation handles digital rights casework inside Serbia. Neither body is a regulator, but their forensic reports have fed into investigations by the European Data Protection Supervisor and national data protection authorities across the EU.
Serbia's Commissioner for Information of Public Importance and Personal Data Protection has jurisdiction here. Previous Pegasus findings in the country have gone unanswered by authorities. NSO Group has consistently maintained that its products are sold only to legitimate government clients and that misuse is investigated.
Should you worry about this?
Most people aren't Pegasus targets. The tool is expensive and reserved for people governments care about: activists, dissidents, senior officials. That said, a few steps apply to anyone with concerns about phone spying.
Keep iOS on the latest version. Restart your phone daily, which can flush some spyware from memory. If you're a journalist or working in politically sensitive fields, turn on Lockdown Mode and look into Apple's Threat Notifications programme.
If Apple sends you a state-sponsored attack notification, treat it seriously and reach out to a group like Access Now's Digital Security Helpline.
