Threat reportMalwareTL-2026-3873
Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy used against Serbian student-movement, opposition and civil-society targets ahead of October 2026 elections
Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy (TL-2026-3873), also tracked as Serbia Pegasus and NoviSpy 2026 campaign, is a high-severity malware campaign, first published 2026-10-19 and last reviewed 2026-10-27. It is attributed to Night Tsunami (Serbia) with medium confidence, affects Apple iOS (iMessage), maps to 11 MITRE ATT&CK techniques (T1409, T1429, T1461), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 1Night Tsunami
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3873
- Threat ID
- TL-2026-3873
- Also known as
- Serbia Pegasus and NoviSpy 2026 campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Night Tsunami
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Serbia
- Motivation
- ESPIONAGE
- Target sectors
- civil society, education, government administration, legal, news - media
- Target regions
- serbia, Balkans, Europe
- Detection rules
- 9
- Indicators of compromise
- 16
- Updates
- 2026-10-27 · 3 updates · revalidated 3× · latest source
Malware and tooling in Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy
Malware and tooling: Chrysaor, NoviSpy, Cellebrite UFED, Mobile Verification Toolkit (MVT)
How Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy works
SHARE Foundation, Citizen Lab and Amnesty International's Security Lab documented at least 14 people in Serbia targeted with mercenary spyware since early 2026. Citizen Lab confirmed Pegasus on a student activist's iPhone via an iMessage zero-click exploit, and CyberScoop reports Pegasus on the device of University of Belgrade Rector Vladan Đokić. A new NoviSpy variant was found on Android devices.
On 2026-09-02 the SHARE Foundation published findings that at least 14 people connected to Serbia's student protest movement, civil society and opposition politics had been targeted with advanced spyware since early 2026. The cohort includes student movement members, activists, an opposition member of parliament and a local councilor. Twelve people received Apple threat notifications in August 2026. Citizen Lab (University of Toronto) and Amnesty International's Security Lab independently confirmed several cases.
Citizen Lab confirmed with high confidence that the iPhone of a student-movement member was infected with NSO Group's Pegasus through an iMessage zero-click exploit. The exploit needed no click or file open. High-confidence infection indicators date to December 2025 - January 2026, and additional infections were not ruled out. Public reporting says Apple has since patched the exploit as of iOS 18.4.1 (released April 2025). The sources do not name a CVE. Pegasus gives the operator everything the user can do on the device, including notes, pictures and encrypted messages, plus covert microphone and camera activation. The timing coincided with Serbia's local elections on 2026-03-29.
Amnesty's Security Lab separately confirmed a new variant of NoviSpy, an Android spyware that Amnesty attributed to Serbia's Security Information Agency (BIA) with high confidence in its earlier 2024 research. One 2026 NoviSpy infection followed police confiscation of a student's phone during questioning. A second followed the disclosure of the victim's private Viber messages on the pro-government outlet Informer TV. In earlier cases NoviSpy was installed during police detention after Cellebrite UFED tools unlocked the device. Amnesty's Donncha Ó Cearbhaill said the evidence suggests infections are carried out during detention by Serbian authorities.
On 2026-10-19 CyberScoop reported that SHARE Foundation and Citizen Lab found Pegasus on the device of Vladan Đokić, Rector of the University of Belgrade and a backer of the student protests, with infection confirmed in 2026 via a zero-click exploit. A second target, Rade Bajić of the Public Prosecutor's Office for Organized Crime, received an Apple threat notification, but the spyware on his device is unconfirmed. Parliamentary elections are scheduled for 2026-10-25. The Pegasus operator has not been publicly identified. Serbian officials, including the intelligence agency, President Vučić and Speaker Brnabić, denied involvement or said they had seen no evidence. Citizen Lab researchers said Serbia is looking like a buffet of mercenary spyware.
None of the cited sources publish network IOCs (domains, IPs, hashes or package names). Amnesty maintains NoviSpy indicators for use with the Mobile Verification Toolkit on GitHub. Defenders should rely on Apple threat notifications, MVT-based forensics and the platform hardening listed under remediation.
MITRE ATT&CK techniques used in TL-2026-3873
Collection
T1409 Stored Application Data; T1429 Audio Capture; T1512 Video Capture; T1513 Screen Capture; T1533 Data from Local System; T1636 Protected User Data
Initial Access
T1461 Lockscreen Bypass; T1660 Phishing; T1664 Exploitation for Initial Access
Exfiltration
T1646 Exfiltration Over C2 Channel
Execution
Affected products and versions in Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy
Remediation for Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy
Patches
- Apple iOS 18.4.1 or later (per Citizen Lab, the exploited iMessage zero-click was patched as of iOS 18.4.1)
Immediate actions
- Update all iPhones to the latest iOS release; the zero-click iMessage exploit was patched in iOS 18.4.1 or earlier
- Enable iOS Lockdown Mode for at-risk users (journalists, activists, politicians, officials)
- Treat any Apple threat notification as high-confidence mercenary-spyware targeting and contact Access Now Digital Security Helpline, SHARE Foundation, Citizen Lab or Amnesty Security Lab
- Do not unlock or hand over phones during police questioning where avoidable; Android devices handed over in detention were infected with NoviSpy
Workarounds
- Lockdown Mode on iOS
- Disable iMessage on high-risk devices where operationally feasible
Longer-term hardening
- Scan device backups or sysdiagnose data with the Mobile Verification Toolkit (MVT) using Amnesty's NoviSpy and published Pegasus indicators
- Enable Google Advanced Protection Program on Android and WhatsApp Strict Account Settings for high-risk users
- Maintain regular device updates and device-replacement procedures for confirmed-infected high-risk users
Timeline of Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy
Showing the 20 most recent tracked events.
- Failed advanced-spyware attempts against two Serbian civil-society members (August 2023), with forensic evidence consistent with Pegasus delivery techniques.
- Amnesty Security Lab, SHARE Foundation and partners publicly disclose attempted advanced-spyware attacks on Serbian civil society; forensic traces were consistent with Pegasus delivery techniques (first recorded Serbian cases).
- Student-led pro-democracy protests begin in Serbia (November 2024; exact day not stated), the movement later targeted by spyware.
- Amnesty reports Serbian police and BIA using NoviSpy on Android plus Cellebrite UFED against journalists and activists, attributing NoviSpy to BIA with high confidence.
- Two BIRN journalists receive Pegasus 1-click links via Viber from a Telekom Srbija number using an n1info.com decoy; published by Amnesty on 2025-03-18.
- Apple releases iOS 18.4.1, the version Citizen Lab reports as patching the iMessage zero-click exploit used in the Serbian Pegasus infection.
- Prosecutor Rade Bajić is moved off the Trump Tower corruption case (November 2025; exact day not given), months before his August 2026 Apple threat notification.
- Start of the December 2025 - January 2026 window containing high-confidence Pegasus infection indicators on a Serbian student activist's iPhone.
- Serbian local elections; targeting waves coincide with this period per SHARE Foundation and Citizen Lab.
- Government raid on the offices of University of Belgrade Rector Vladan Đokić.
- Twelve Serbian individuals receive Apple threat notifications in August 2026, prompting SHARE Foundation forensic investigation.
- Prosecutor Rade Bajić receives the first Apple Threat Notification (per Citizen Lab's 2026-10-19 report); forensic analysis of his device is ongoing.
- Bajić receives a second Apple Threat Notification; Citizen Lab assesses a high likelihood he was targeted.
- SHARE Foundation reports at least 14 targets since early 2026; Citizen Lab confirms Pegasus via iMessage zero-click and Amnesty confirms a new NoviSpy variant on Android.
- Citizen Lab's John Scott-Railton describes Serbia as beginning to look like a buffet of mercenary spyware; Serbian officials deny involvement.
- CyberScoop reports SHARE Foundation and Citizen Lab found Pegasus on University of Belgrade Rector Vladan Đokić's device (zero-click, infection confirmed in 2026); prosecutor Rade Bajić received an Apple threat notification with spyware type unconfirmed.
- The Guardian publishes the Đokić and Bajić findings.
- Serbia holds snap parliamentary elections.
- Serbian parliamentary elections scheduled.
- Citizen Lab publishes its article on the Bajić and Đokić cases and reports at least 15 Pegasus targeting cases in Serbia ahead of the elections.
Update history for TL-2026-3873
- 2026-10-27 — Pegasus Spyware Targeting of Serbian Prosecutor Rade Bajić and University of Belgrade Rector Vladan Đokić Ahead of October 25 Elections: What changed No field escalations. Severity HIGH, exploitability ACTIVE and status ACTIVE are unchanged. The case count is now reported as at least 15-16 targets, up from 14. New indicators (4) Four entity/behavioral indicators added: Apple
- 2026-10-20 — Pegasus Spyware Zero-Click Infection Confirmed on Serbian University of Belgrade Rector's iPhone Ahead of Election: What changed No severity, exploitability or status change; both are already HIGH / ACTIVE. The report adds detail: Citizen Lab's primary publication (2026-10-19) confirms Pegasus on Rector Vladan Đokić's iPhone with high confidence via zero
- 2026-10-19 — Pegasus spyware targeting Serbian opposition figures ahead of elections (Đokić, Bajić) and NoviSpy/Cellebrite surveillance wave: What changed No severity, exploitability, status or attribution-confidence change (HIGH / ACTIVE / ACTIVE / MEDIUM unchanged). The newer report puts the number of people targeted in 2026 at least 15, up from 14. It adds that the 2026 NoviSp
Sources cited for Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy
- Spyware found on devices belonging to prominent Serbian critics as elections loom
- Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist
- Pegasus and NoviSpy variant spyware found on devices of Serbian activists
- Pegasus and NoviSpy Used Against Serbian Protesters
- Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone
- Opposition and student activists in Serbia targeted with advanced spyware
- Citizen Lab on surveillance targeting students: Serbia beginning to look like a buffet of mercenary spyware
- Serbia: Authorities using spyware and Cellebrite forensic extraction tools to hack journalists and activists
- Serbia: Civil society threatened by spyware
Detection coverage for TL-2026-3873
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3873 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.