# Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy used against Serbian student-movement, opposition and civil-society targets ahead of October 2026 elections

> SHARE Foundation, Citizen Lab and Amnesty International's Security Lab documented at least 14 people in Serbia targeted with mercenary spyware since early 2026. Citizen Lab confirmed Pegasus on a student activist's iPhone via an iMessage zero-click exploit, and CyberScoop reports Pegasus on the device of University of Belgrade Rector Vladan Đokić. A new NoviSpy variant was found on Android devices.

- **Published:** 2026-10-19T10:15:21Z
- **Last reviewed:** 2026-10-27T17:26:29.497Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3873
- **ID:** TL-2026-3873
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Night Tsunami (Serbia)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-02 the SHARE Foundation published findings that at least 14 people connected to Serbia's student protest movement, civil society and opposition politics had been targeted with advanced spyware since early 2026. The cohort includes student movement members, activists, an opposition member of parliament and a local councilor. Twelve people received Apple threat notifications in August 2026. Citizen Lab (University of Toronto) and Amnesty International's Security Lab independently confirmed several cases.

Citizen Lab confirmed with high confidence that the iPhone of a student-movement member was infected with NSO Group's Pegasus through an iMessage zero-click exploit. The exploit needed no click or file open. High-confidence infection indicators date to December 2025 - January 2026, and additional infections were not ruled out. Public reporting says Apple has since patched the exploit as of iOS 18.4.1 (released April 2025). The sources do not name a CVE. Pegasus gives the operator everything the user can do on the device, including notes, pictures and encrypted messages, plus covert microphone and camera activation. The timing coincided with Serbia's local elections on 2026-03-29.

Amnesty's Security Lab separately confirmed a new variant of NoviSpy, an Android spyware that Amnesty attributed to Serbia's Security Information Agency (BIA) with high confidence in its earlier 2024 research. One 2026 NoviSpy infection followed police confiscation of a student's phone during questioning. A second followed the disclosure of the victim's private Viber messages on the pro-government outlet Informer TV. In earlier cases NoviSpy was installed during police detention after Cellebrite UFED tools unlocked the device. Amnesty's Donncha Ó Cearbhaill said the evidence suggests infections are carried out during detention by Serbian authorities.

On 2026-10-19 CyberScoop reported that SHARE Foundation and Citizen Lab found Pegasus on the device of Vladan Đokić, Rector of the University of Belgrade and a backer of the student protests, with infection confirmed in 2026 via a zero-click exploit. A second target, Rade Bajić of the Public Prosecutor's Office for Organized Crime, received an Apple threat notification, but the spyware on his device is unconfirmed. Parliamentary elections are scheduled for 2026-10-25. The Pegasus operator has not been publicly identified. Serbian officials, including the intelligence agency, President Vučić and Speaker Brnabić, denied involvement or said they had seen no evidence. Citizen Lab researchers said Serbia is looking like a buffet of mercenary spyware.

None of the cited sources publish network IOCs (domains, IPs, hashes or package names). Amnesty maintains NoviSpy indicators for use with the Mobile Verification Toolkit on GitHub. Defenders should rely on Apple threat notifications, MVT-based forensics and the platform hardening listed under remediation.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1658 Exploitation for Client Execution
- T1429 Audio Capture
- T1512 Video Capture
- T1513 Screen Capture
- T1533 Data from Local System
- T1636 Protected User Data
- T1660 Phishing
- T1646 Exfiltration Over C2 Channel
- T1461 Lockscreen Bypass
- T1409 Stored Application Data

## Sources

- [Spyware found on devices belonging to prominent Serbian critics as elections loom](https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/)
- [Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist](https://citizenlab.ca/research/pegasus-spyware-infection-of-)
- [Pegasus and NoviSpy variant spyware found on devices of Serbian activists](https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/)
- [Pegasus and NoviSpy Used Against Serbian Protesters](https://securityaffairs.com/198377/intelligence/pegasus-and-novispy-used-against-serbian-protesters.html)
- [Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone](https://thehackernews.com/2026/09/pegasus-zero-click-spyware-exploit.html)
- [Opposition and student activists in Serbia targeted with advanced spyware](https://europeanwesternbalkans.com/2026/09/03/opposition-and-student-activists-in-serbia-targeted-with-advanced-spyware/)
- [Citizen Lab on surveillance targeting students: Serbia beginning to look like a buffet of mercenary spyware](https://n1info.rs/english/news/citizen-lab-on-surveillance-targeting-students-serbia-beginning-to-look-like-a-buffet-of-mercenary-spyware/)
- [Serbia: Authorities using spyware and Cellebrite forensic extraction tools to hack journalists and activists](https://securitylab.amnesty.org/?p=194812)
- [Serbia: Civil society threatened by spyware](https://securitylab.amnesty.org/latest/2023/11/serbia-civil-society-threatened-by-spyware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3873