Member of Serbia's student protest movement hit by network compromise linked to NSO Group
Incident
Summary
Hide ▲
Show ▼
A member of Serbia's student protest movement was infected on an iPhone with NSO Group's Pegasus through an iMessage zero-click exploit. The forensic review by Citizen Lab and the SHARE Foundation found high-confidence indicators of infection across December 2025 – January 2026, and the attack was believed to have been patched by Apple in iOS 18.4.1. The compromise fits a broader pattern of mercenary spyware targeting people linked to Serbia's protest movement and civil society ahead of 2026 election cycles.
Related Happenings
Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
Trend
H score7
First: 03.09.2026 11:43
Last: 03.09.2026 11:43
Sources 1
How related:
In all, at least 14 people in Serbia have been targeted with advanced spyware since the beginning of 2026, the SHARE Foundation confirmed.
About this happening:
At least 14 people in Serbia have been targeted with advanced spyware since early 2026, concentrating risk on student movement members, activists, an opposition MP,...
Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
TrendHow related: In all, at least 14 people in Serbia have been targeted with advanced spyware since the beginning of 2026, the SHARE Foundation confirmed.
About this happening: At least 14 people in Serbia have been targeted with advanced spyware since early 2026, concentrating risk on student movement members, activists, an opposition MP,...
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
H score28
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignAbout this happening: A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
CHOSEN BRICK is a Windows malware campaign attributed to Iranian state-linked hackers targeting dissidents, activists, and journalists worldwide. The campaign uses...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: CHOSEN BRICK is a Windows malware campaign attributed to Iranian state-linked hackers targeting dissidents, activists, and journalists worldwide. The campaign uses...
Latest development: 16.09.2026 23:24
Iranian state-linked hackers are using CHOSEN BRICK, a Windows malware strain, against dissidents, activists, and journalists worldwide. The campaign uses social engineering messages sent via WhatsApp and Telegram to impersonate trusted contacts or technical support, lures victims into opening fake apps such as Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, installs the payload through convincing decoy interfaces, persists with Windows Registry Run keys, adds Microsoft Defender exclusions, and exfiltrates email, Telegram, and WhatsApp data through Telegram and services such as VultrObjects and StorjShare.
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
Campaign
H score38
First: 09.03.2026 23:24
Last: 09.03.2026 23:24
Sources 1
About this happening:
An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Russian state-sponsored hackers' ongoing Signal and WhatsApp phishing campaign
CampaignAbout this happening: An ongoing Russian intelligence-linked phishing campaign is targeting Signal and WhatsApp users and has evolved from stealing verification codes and account PINs t...
Latest development: 27.06.2026 01:06
FBI and CISA warn that the Russian intelligence services-linked Signal phishing campaign has evolved from stealing verification codes, account PINs, and linked-device access to eliciting victims' Backup Recovery Keys through impersonated Signal support messages. If a target provides the key, attackers can restore Signal's Secure Backups on their own devices and read historical messages, including private and group conversations, while the campaign continues to target high-intelligence-value individuals.
Predator spyware targeting Teixeira Cândido's iPhone
Malware Activity
H score25
First: 18.02.2026 19:30
Last: 18.02.2026 19:30
Sources 1
About this happening:
Predator spyware successfully targeted Teixeira Cândido's iPhone in May 2024, giving an attacker the ability to gain unrestricted access to the device. The infecti...
Predator spyware targeting Teixeira Cândido's iPhone
Malware ActivityAbout this happening: Predator spyware successfully targeted Teixeira Cândido's iPhone in May 2024, giving an attacker the ability to gain unrestricted access to the device. The infecti...
Timeline
-
03.09.2026 11:43 3 articles · 13d ago
Member of Serbia's student protest movement hit by network compromise linked to NSO Group
Initial DisclosureA Pegasus infection was identified on a Serbian student protest movement member's iPhone during a forensic review of activity spanning December 2025 – January 2026. The compromise used an iMessage zero-click exploit, indicating targeted surveillance without user interaction.
Show sources
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43
- Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone — www.infosecurity-magazine.com — 03.09.2026 18:25