Pegasus Spyware Infects Serbian Student iPhone via Zero-Click Exploit

Introduction

In an alarming revelation that underscores the growing threat posed by commercial spyware, security researchers have documented how NSO Group's notorious Pegasus surveillance tool was successfully deployed against a member of Serbia's prominent student protest movement. The Citizen Lab at the University of Toronto, working in close partnership with the Belgrade-based SHARE Foundation, has confirmed that the victim's iPhone was compromised through an iMessage zero-click exploit—a method that requires no interaction from the target whatsoever.

This incident represents yet another chapter in the controversial history of Pegasus, a spyware suite that has been linked to surveillance of journalists, activists, politicians, and human rights defenders worldwide. The targeting of a student demonstrant raises serious questions about the weaponization of commercial cyber intelligence tools against civic movements and the inadequacy of current regulatory frameworks to prevent such abuses.

Understanding the Zero-Click Threat

Zero-click exploits represent the most sophisticated and dangerous category of mobile device vulnerabilities. Unlike traditional attack vectors that require victims to click malicious links, download suspicious files, or grant permissions, zero-click attacks can compromise devices silently and automatically. In the case of the Serbian student activist, the infection occurred simply through the receipt of a message via iMessage—no interaction was necessary.

These exploits typically work by sending specially crafted data packets or messages that trigger memory corruption vulnerabilities in the device's software. Once exploited, the attacker gains deep access to the device, often achieving what security researchers call "jailbreak" status—complete control over the operating system. From that point, the Pegasus spyware can harvest passwords, access encrypted messages, activate cameras and microphones, track location data, and exfiltrate virtually any information stored on the device.

The technical sophistication required to develop and weaponize such exploits places them beyond the capabilities of most threat actors, which is why companies like NSO Group command premium prices for their surveillance capabilities—reportedly reaching hundreds of millions of dollars in government contracts.

The Serbian Student Movement Context

Serbia has experienced significant civic unrest in recent years, with student-led protests emerging as a powerful force for political accountability and social change. These movements have challenged corruption, advocated for media freedom, and demanded greater transparency from government institutions. The targeting of a student activist with state-level surveillance technology suggests that those in power may be attempting to monitor, intimidate, or disrupt legitimate democratic participation.

The Citizen Lab's analysis identified high-confidence indicators that the device was successfully infected with Pegasus, confirming what civil society organizations have long suspected—that commercial spyware is being deployed against individuals exercising their fundamental rights to assembly and expression. The collaboration with the SHARE Foundation has been instrumental in documenting these violations and bringing international attention to the surveillance of civil society in Serbia and the broader Western Balkans region.

The NSO Group Controversy

NSO Group, an Israeli cyber intelligence company, has positioned itself as a defender of national security interests, claiming its products help governments combat terrorism and serious crime. However, the company has faced relentless scrutiny and legal challenges following revelations that its spyware has been used to target perceived political opponents, independent journalists, and human rights advocates.

The United States Commerce Department added NSO Group to its Entity List in 2021, effectively restricting American companies from doing business with the firm. Apple has filed a lawsuit against NSO Group, while Meta (Facebook's parent company) has taken legal action over WhatsApp vulnerabilities exploited by the company. Despite these measures, NSO Group continues to operate and maintain government clients, raising questions about the effectiveness of international export controls on surveillance technology.

Key Concerns About Commercial Spyware

• Lack of accountability: Private companies selling surveillance tools to governments create accountability gaps where abuses can occur without proper oversight
• Mission creep: Tools designed for counter-terrorism are routinely repurposed for political surveillance and repression
• Irreversible infections: Once Pegasus infects a device, the victim has no reliable way to detect or remove the spyware
• Chilling effects: Knowledge that one may be surveilled can deter legitimate civic participation and free expression

Protecting Against Advanced Mobile Threats

For individuals at elevated risk of targeting by sophisticated adversaries, conventional security advice falls short. Zero-click exploits can compromise devices without any user error, making traditional hygiene practices insufficient. Security researchers recommend a defense-in-depth approach that acknowledges the inherent limitations of any single protective measure.

Device updates remain critical, as they patch known vulnerabilities that spyware often exploits. Using encrypted messaging applications that have been independently audited can reduce exposure to certain attack vectors. Activists and journalists should consider compartmentalizing sensitive communications across multiple devices, limiting the potential impact of a successful compromise. For high-risk individuals, specialized security training and infrastructure review by qualified professionals can identify and address vulnerabilities that generic guidance cannot address.

Broader Implications for Digital Rights

The case of the Serbian student activist is not an isolated incident but rather part of a troubling global pattern documented by organizations including Amnesty International, Forbidden Stories, and the Citizen Lab. Investigations have documented Pegasus infections in countries including Mexico, Saudi Arabia, India, Azerbaijan, and numerous European nations, targeting individuals ranging from murdered journalists to heads of state.

Civil society organizations argue that the commercial spyware industry operates in a regulatory vacuum that enables human rights abuses while generating enormous profits for technology companies. Calls for moratoriums on the sale and transfer of surveillance technology have gained traction, though major producing countries have been reluctant to impose meaningful restrictions that might limit their own intelligence capabilities or domestic technology sectors.

The European Union has taken initial steps toward regulating the spyware industry through its cybersecurity certification frameworks and discussions around potential export controls, though comprehensive legislation remains elusive. Human rights advocates continue to push for binding international standards that would hold both governments and private companies accountable for surveillance abuses.

Conclusion

The documented infection of a Serbian student activist's iPhone with NSO Group's Pegasus spyware serves as a stark reminder that sophisticated surveillance capabilities developed by private companies pose an existential threat to civic space and democratic participation worldwide. The use of zero-click exploits that require no victim interaction makes traditional security awareness training irrelevant and places the burden of protection entirely on the defenders rather than the targeted individuals.

As the commercial spyware industry continues to evolve and proliferate, the international community faces a critical choice: to establish meaningful guardrails that prevent the misuse of surveillance technology against legitimate civil society actors, or to allow a shadow market in cyber intelligence to operate with impunity. For organizations and individuals navigating an increasingly hostile digital environment, understanding these threats and implementing robust defensive measures is no longer optional. Grivyonx Cloud remains committed to providing cutting-edge AI automation and cybersecurity intelligence that helps civil society, journalists, and activists defend themselves against advanced persistent threats.