Member of Serbia's student protest movement hit by network compromise linked to NSO Group
Incident
Summary
Hide ▲
Show ▼
The iPhone of a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware through an iMessage zero-click exploit, creating a high-confidence spyware compromise. The infection window spans December 2025 – January 2026, and the exploit path had already been addressed by Apple in iOS 18.4.1. The case adds to a broader pattern of advanced spyware targeting people linked to Serbian protests and opposition politics.
Related Happenings
Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
Trend
H score7
First: 03.09.2026 11:43
Last: 03.09.2026 11:43
Sources 1
How related:
In all, at least 14 people in Serbia have been targeted with advanced spyware since the beginning of 2026, the SHARE Foundation confirmed.
About this happening:
At least 14 people in Serbia have been targeted with advanced spyware since early 2026, concentrating risk on student movement members, activists, and opposition fig...
Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
TrendHow related: In all, at least 14 people in Serbia have been targeted with advanced spyware since the beginning of 2026, the SHARE Foundation confirmed.
About this happening: At least 14 people in Serbia have been targeted with advanced spyware since early 2026, concentrating risk on student movement members, activists, and opposition fig...
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
H score28
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignAbout this happening: A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
Campaign
H score38
First: 09.03.2026 23:24
Last: 09.03.2026 23:24
Sources 1
About this happening:
An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
CampaignAbout this happening: An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Latest development: 27.06.2026 01:06
FBI and CISA warn that the Russian intelligence services-linked Signal phishing campaign has evolved from stealing verification codes, account PINs, and linked-device access to eliciting victims' Backup Recovery Keys through impersonated Signal support messages. If a target provides the key, attackers can restore Signal's Secure Backups on their own devices and read historical messages, including private and group conversations, while the campaign continues to target high-intelligence-value individuals.
Predator spyware targeting Teixeira Cândido's iPhone
Malware Activity
H score25
First: 18.02.2026 19:30
Last: 18.02.2026 19:30
Sources 1
About this happening:
Predator spyware successfully targeted Teixeira Cândido's iPhone in May 2024, giving an attacker the ability to gain unrestricted access to the device. The infecti...
Predator spyware targeting Teixeira Cândido's iPhone
Malware ActivityAbout this happening: Predator spyware successfully targeted Teixeira Cândido's iPhone in May 2024, giving an attacker the ability to gain unrestricted access to the device. The infecti...
Timeline
-
03.09.2026 11:43 2 articles · 2h ago
Member of Serbia's student protest movement hit by network compromise linked to NSO Group
Initial DisclosureA Pegasus infection was identified on a Serbian student protest movement member's iPhone during a forensic review of activity spanning December 2025 – January 2026. The compromise used an iMessage zero-click exploit, indicating targeted surveillance without user interaction.
Show sources
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43