Pegasus Zero-Click Spyware Hits Serbian Student Protest Member

A recent investigation by the Citizen Lab in partnership with the SHARE Foundation has confirmed that a member of Serbia’s student protest movement was targeted with NSO Group’s Pegasus spyware. The device—a standard iPhone—was compromised through a “zero‑click” vulnerability triggered simply by receiving a malicious iMessage. This type of attack requires no user interaction beyond opening the message thread, making it especially insidious for individuals who may be wary of phishing links ¹.

The analysis identified high‑confidence indicators that Pegasus had been installed on the phone. According to the report, the infection vector involved exploiting weaknesses in Apple’s messaging stack that allow remote code execution without elevating privileges. While Apple routinely patches such vulnerabilities, they are frequently re‑tested by zero‑day developers; similar exploits have surfaced against journalists and political activists since at least mid‑2018. In this case, the target’s role as a public activist likely made them an attractive victim for state‑sponsored surveillance operations ¹.

Experts note that while Apple has patched many of these flaws over successive releases, the rapid pace of new vulnerability discovery means that any given OS version can become compromised before a patch lands. This incident illustrates why continuous monitoring of message traffic and stricter sandboxing around incoming data streams are critical. Without robust integrity checks, attackers can inject malicious payloads that bypass standard application permissions entirely.

Users who receive unexpected iMessages from unknown senders should treat them with caution; meanwhile, organizations operating under surveillance threats may need to enforce stricter controls on device usage or consider alternative communication channels less exposed to this class of exploits ¹.

In sum, this case demonstrates how state‑backed spyware like Pegasus can leverage seemingly innocuous messaging features to breach privacy. It also highlights the ongoing arms race between sophisticated adversaries and mobile platform defenders, underscoring the necessity for continual vigilance and improved platform hardening measures.