Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
Trend
Summary
Hide ▲
Show ▼
At least 14 people in Serbia have been targeted with advanced spyware since early 2026, concentrating risk on student movement members, activists, an opposition MP, and a local councilor. The pattern includes Pegasus and NoviSpy cases across iPhone and Android devices, pointing to sustained surveillance pressure on politically visible people rather than a one-off compromise. A new forensic report says a Serbian student protest member's iPhone was infected with NSO Group's Pegasus through an iMessage zero-click exploit that the researchers believed had been patched by Apple in iOS 18.4.1. The notification was among at least 14 documented by the SHARE Foundation, and the case was linked to ongoing targeting ahead of 2026 election cycles.
Related Happenings
Member of Serbia's student protest movement hit by network compromise linked to NSO Group
Incident
H score9
First: 03.09.2026 11:43
Last: 03.09.2026 11:43
Sources 1
How related:
A member of Serbia's student protest movement has been infected with NSO Group's Pegasus spyware through an iMessage zero-click exploit, according to a forensic investigation by the Citizen Lab and the SHARE Foundation.
About this happening:
A member of Serbia's student protest movement was infected on an iPhone with NSO Group's Pegasus through an iMessage zero-click exploit. The forensic review by C...
Member of Serbia's student protest movement hit by network compromise linked to NSO Group
IncidentHow related: A member of Serbia's student protest movement has been infected with NSO Group's Pegasus spyware through an iMessage zero-click exploit, according to a forensic investigation by the Citizen Lab and the SHARE Foundation.
About this happening: A member of Serbia's student protest movement was infected on an iPhone with NSO Group's Pegasus through an iMessage zero-click exploit. The forensic review by C...
Jewelbug pairs espionage with industrial-scale cryptocurrency fraud
Threat Actor Meta
H score62
First: 13.08.2026 21:15
Last: 13.08.2026 21:15
Sources 1
About this happening:
Jewelbug is a China-linked threat actor operating a blended espionage and cryptocurrency fraud ecosystem. Broadcom’s Symantec and Carbon Black Threat Hunter...
Jewelbug pairs espionage with industrial-scale cryptocurrency fraud
Threat Actor MetaAbout this happening: Jewelbug is a China-linked threat actor operating a blended espionage and cryptocurrency fraud ecosystem. Broadcom’s Symantec and Carbon Black Threat Hunter...
GreyVibe custom malware activity with LegionRelay, PhantomRelay, and FallSpy
Malware Activity
H score41
First: 29.05.2026 01:24
Last: 29.05.2026 01:24
Sources 1
About this happening:
GREYVIBE is a Russian-speaking malware activity targeting Ukraine and Ukraine-related entities since at least August 2025. The group uses spear-phishing e-mails*...
GreyVibe custom malware activity with LegionRelay, PhantomRelay, and FallSpy
Malware ActivityAbout this happening: GREYVIBE is a Russian-speaking malware activity targeting Ukraine and Ukraine-related entities since at least August 2025. The group uses spear-phishing e-mails*...
NCSC-UK joint advisory on covert botnets and proxy networks
Public Sector Action
H score66
First: 23.04.2026 15:28
Last: 23.04.2026 15:28
Sources 1
About this happening:
NCSC-UK and partner agencies issued a joint advisory warning that China-nexus hackers are using hijacked consumer devices as covert proxy networks to hide maliciou...
NCSC-UK joint advisory on covert botnets and proxy networks
Public Sector ActionAbout this happening: NCSC-UK and partner agencies issued a joint advisory warning that China-nexus hackers are using hijacked consumer devices as covert proxy networks to hide maliciou...
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
H score28
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignAbout this happening: A spear-phishing campaign targeted civil society figures in Middle Eastern countries, including three journalists in Egypt and Lebanon, creating account-compromise ris...
Timeline
-
03.09.2026 11:43 3 articles · 13d ago
Recurring advanced-spyware targeting of political and civic figures in Serbia since early 2026
Initial DisclosureBy early 2026, Serbia was seeing a recurring spyware targeting pattern focused on politically active and protest-linked people. The concentration of cases around opposition and student movement figures points to sustained surveillance pressure on civic actors.
Show sources
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43
- Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone — thehackernews.com — 03.09.2026 11:43
- Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone — www.infosecurity-magazine.com — 03.09.2026 18:25