Global Surge in Mercenary Spyware: Apple Issues Mass Alerts Amidst Escalating Surveillance in Serbia

Executive Summary

In mid-August 2026, Apple initiated a global security alert, notifying users in 110 countries that they have been individually targeted by mercenary spyware. This development coincides with a significant surge in documented surveillance activity in Serbia, where researchers from the SHARE Foundation confirmed that at least 14 individuals, including student activists and opposition lawmakers, were compromised by advanced tools such as Pegasus and the previously less-documented NoviSpy. These events underscore the persistent and evolving threat posed by commercial exploit brokers and state-aligned surveillance operations.

Threat Analysis

Mercenary spyware represents a tier of digital threat characterized by extreme cost, high technical sophistication, and targeted deployment. Unlike broad-spectrum malware, these tools are designed for precision, often utilizing zero-click exploits to gain full control over mobile devices without user interaction. The recent alerts from Apple indicate that the infrastructure used by these actors is becoming more pervasive, with the company having now notified users in over 150 countries since 2021. The shift toward on-device, lock-screen notifications reflects an urgent need to bypass traditional communication channels that may themselves be compromised.

Technical Details

Recent investigations into the Serbian campaign revealed the use of zero-click exploits that bypass standard iOS security protections. The NoviSpy tool, in particular, has been identified as a modular surveillance framework capable of exfiltrating encrypted messaging data, real-time location tracking, and microphone activation. These tools often leverage undisclosed vulnerabilities in system-level processes. Furthermore, the emergence of the 'Manic' Android malware—which utilizes Wi-Fi mesh networking to exfiltrate data from offline devices—demonstrates that mobile surveillance is rapidly expanding beyond traditional cellular and internet-based vectors, creating new challenges for digital forensics and incident response.

Attribution Assessment

While Apple maintains a policy of not attributing these attacks to specific nation-states or entities, the nature of the targets—journalists, activists, and political figures—strongly suggests state-sponsored or state-procured operations. In the Serbian context, local authorities have publicly denied involvement, labeling the findings as sensationalism. However, the technical overlap between the tools used and known commercial spyware suites points to the involvement of established exploit brokers who operate in the gray market, selling access to government clients under the guise of 'lawful interception.'

Implications

The proliferation of these tools poses a critical risk to democratic processes and human rights. When political opposition and civil society are subjected to persistent, invisible surveillance, the integrity of public discourse is fundamentally undermined. The ability of these tools to operate across borders and bypass standard security updates necessitates a more robust, collaborative approach to mobile device security and international regulation of the spyware trade.

Recommendations

1. Enable Lockdown Mode: High-risk individuals should immediately enable Lockdown Mode on their iOS devices to restrict the attack surface for zero-click exploits.
2. Device Hygiene: Regularly audit installed profiles and applications, and avoid clicking suspicious links or installing software from third-party sources.
3. Operational Security: For those in high-risk sectors, utilize hardware-based security keys and consider the use of secondary, 'clean' devices for sensitive communications.
4. Incident Reporting: If a threat notification is received, engage with specialized digital security organizations like Citizen Lab or Amnesty International for forensic analysis.