Citizen Lab (2 September 2026), with the SHARE Foundation, confirmed that an iPhone belonging to a member of Serbia’s student protest movement was infected with NSO Group’s Pegasus spyware via an iMessage zero-click exploit. High-confidence indicators cover December 2025–January 2026; Citizen Lab assesses the exploit was addressed in Apple iOS 18.4.1 (April 2025). SHARE has documented at least 14 recent Apple Threat Notifications among Serbian students, civil society and an opposition MP ahead of 2026 election cycles; Amnesty has separately described related Android spyware (NoviSpy-like) installed during detention.

Primary: Citizen Lab research note. Recipients of Apple Threat Notifications should treat devices as presumed targeted and seek forensic help; keep iOS current.

UPDATE 19 October 2026 (Citizen Lab research note with the SHARE Foundation): two more cases bring to at least 16 the members of Serbian civil society publicly known to have been targeted or infected with mercenary spyware. Citizen Lab found with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the student pro-democracy movement (his offices were raided by Serbian authorities on 31 March 2026), was infected with NSO Group's Pegasus in 2026 through a zero-click exploit that needed no click or file opening; the investigation is ongoing and Citizen Lab has not named the exploit or iOS version.

Rade Bajić, a former senior prosecutorial associate at the Belgrade organised-crime prosecutor's office who worked on the 'Generalštab' corruption case over the planned Belgrade 'Trump Tower' project, received an Apple Threat Notification on 13 August 2026 and a reminder on 27 August, which Citizen Lab treats as a high-confidence sign of likely mercenary-spyware targeting; forensic analysis of his device continues. The findings come ahead of Serbia's 25 October 2026 snap parliamentary election.

Citizen Lab advises Apple Threat Notification recipients to seek expert help at once (in Serbia, the SHARE Foundation; elsewhere, Access Now's Digital Security Helpline), have close contacts screened, enable Lockdown Mode and keep devices updated.