Escalating Mercenary Spyware Campaign Targets Activists and Politicians Across 110 Countries

Executive Summary

In mid-August 2026, Apple initiated a global security alert, notifying users in 110 countries that they had been targeted by sophisticated mercenary spyware. This campaign represents one of the most widespread coordinated surveillance efforts documented to date. Subsequent forensic analysis, particularly in Serbia, has linked these alerts to the deployment of advanced zero-click exploits, including the notorious Pegasus spyware and a secondary tool identified as NoviSpy.

Threat Analysis

Mercenary spyware, often developed by private firms and sold to state actors, represents a critical threat to human rights defenders, journalists, and political figures. Unlike traditional malware, these tools utilize zero-click vulnerabilities that require no user interaction to compromise a device. The recent surge in notifications suggests that exploit brokers are operating with increased frequency, leveraging high-cost, high-sophistication chains to bypass modern mobile security protections.

Technical Details

Recent findings from the SHARE Foundation and independent researchers confirm that targets in Serbia were compromised via zero-click vectors. The infection chain for these tools typically involves exploiting memory corruption vulnerabilities in system-level processes, allowing the spyware to gain persistent, unauthorized access to the device's microphone, camera, location data, and encrypted messaging databases. The emergence of 'NoviSpy' alongside Pegasus indicates a diversification of the surveillance toolkit, potentially designed to evade signature-based detection systems.

Attribution Assessment

While Apple maintains a policy of not attributing these attacks to specific entities, the nature of the tools—specifically Pegasus—points toward state-sponsored actors or government-contracted intelligence agencies. In the Serbian context, local authorities have denied involvement, yet the scale of the targeting against opposition lawmakers and student activists strongly implies a politically motivated surveillance operation.

Implications

The proliferation of mercenary spyware poses a systemic risk to global privacy and democratic processes. The ability for non-state actors or smaller nations to purchase 'off-the-shelf' cyber-weaponry has democratized high-end espionage, making it increasingly difficult for high-risk individuals to secure their communications against well-funded adversaries.

Recommendations

1. Enable 'Lockdown Mode' on all Apple devices if you are a high-risk individual (journalists, activists, politicians).
2. Regularly update iOS and macOS to the latest versions to patch known vulnerabilities.
3. Exercise extreme caution with unsolicited links or unexpected messages, even from known contacts.
4. Utilize encrypted communication platforms that support end-to-end verification and consider hardware security keys for account protection.