Ever since Apple started sending out notifications in 2021 alerting customers that have been targeted with mercenary spyware, new cases of abuse have rolled into the Citizen Lab for us to investigate.
Yesterday, we published a new report in collaboration with colleagues at The SHARE Foundation after 14 Serbian protestors, a member of parliament, and a local councillor received Apple notifications warning them their phones had been targeted with spyware.
Our forensic analysis shows that the iPhone of one of those student protestors was infected with a zero-click version of NSO Group’s Pegasus spyware across December 2025 to January 2026. The exploit used in this attack was patched by Apple as of iOS 18.4.1. We are not disclosing the name of the victim at their request.
The Serbian student protest movement emerged in November 2024, and has grown into waves of protest and civil disobedience against the corruption of Serbia’s current government led by President Aleksandar Vučić. Vučić’s regime has responded with repression and propaganda, including the use of excessive force and arrests, and media campaigns aiming to discredit the opposition.
Our latest investigation with The Share Foundation shows that the regime is also apparently willing to do what an unfortunately large number of illiberal regimes are doing: hacking into the phones of peaceful political opposition movements to snoop on them.
This case shows yet again the value of tech companies sending out notifications. Apple’s latest round of notifications (that included the Serbian protestors) is the largest of them so far, and includes victims in more than 100 countries. Stay tuned for more!
Read the full report here: https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/
Read The Share Foundation’s report here: https://sharefoundation.info/en/share-foundation-students-and-opposition-politicians-targeted-by-spyware/
Media
Financial Times: https://www.ft.com/content/c9c3a0ef-98d5-4aeb-9d20-e6250d6fcf99?syn-25a6b1a6=1
The Guardian: https://www.theguardian.com/world/2026/sep/03/serbians-targeted-with-advanced-spyware
Cyberscoop: https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/
![NLRB Citation. Recognition Timeline: Day 38 since WMF declined voluntary recognition July 27, 2026.
US Workers voted YES. 158 YES, 14 NO, 91.9% YES among counted votes, 8.1% NO among counted votes
172 ballots counted, 213 eligible voters, 81% turnout
Reference: [1] NLRB Case-20-RC-391740, tally of ballots, Region 20, San Francisco, CA
Footer: Wiki Workers United/CWA. [union needed]. Solidarity Forever. Healthy Institutions Share Power.](https://cdn.masto.host/socialwikiworkersunitedorg/media_attachments/files/117/210/197/498/248/852/original/aa435a35cdba5c01.webp)
