Mercenary Spyware Wave Uncovered in Serbia Following Massive Multi-Country Apple Threat Alerts

Executive Summary

Recent digital forensics released by the SHARE Foundation and corroborated by Amnesty International's Security Lab and The Citizen Lab revealed that over a dozen civil society members, activists, and opposition politicians in Serbia were targeted by high-tier commercial surveillanceware. The disclosures directly follow a massive wave of Apple mercenary threat notifications dispatched across 110 countries. Confirmed infections involved NSO Group's Pegasus suite and variants aligned with NoviSpy, highlighting a sustained pattern of state-aligned surveillance targeting democratic institutions and human rights defenders ahead of upcoming parliamentary elections.

Threat Analysis

The targeting represents a concentrated campaign against Serbian political dissidents, journalists, and student organizers following civil protests. Forensic examinations established that the offensive operations leveraged both zero-click exploits and stealth payload deployment. Mercenary spyware operations of this tier possess the capability to covertly commandeer mobile devices, enabling live microphone and camera activation, persistent geolocation tracking, full keystroke logging, and exfiltration of encrypted communications from applications such as Signal, WhatsApp, and Telegram.

Technical Details

Investigators identified multiple infection vectors across iOS and Android ecosystems:

• Zero-Click iOS Vectors: At least one confirmed Pegasus compromise relied on a zero-click vulnerability chain targeting mobile processing subcomponents without necessitating victim interaction.
• NoviSpy Tooling: Multiple devices exhibited traces of NoviSpy, an invasive surveillance artifact previously tracked in Southeastern Europe, designed to extract messaging databases, invoke ambient recording, and manipulate operating system permissions via low-level privilege escalation.
• Infrastructure Overlap: Threat actors utilized ephemeral command-and-control (C2) domains routed through multi-layered content delivery proxies, deliberately designed to obfuscate telemetry and resist network-level discovery.

Attribution Assessment

With high confidence, the tooling is attributed to commercial surveillance vendors operating on behalf of government or state-aligned security services. The forensic discovery of Pegasus confirms involvement from entities leveraging NSO Group capabilities, while the concurrent deployment of NoviSpy suggests reliance on specialized exploit brokers and regional offensive contractors providing multi-platform offensive surveillance software.

Implications

The findings underscore the persistent operational viability of commercial spyware vendors despite expanding export restrictions and sanctions. Mobile ecosystems remain high-value vectors for espionage against high-profile individuals, high-risk political candidates, and civic groups. As threat vendors continually invest in zero-click zero-days, off-the-shelf and zero-interaction attacks will continue to bypass standard host-level endpoint defenses.

Recommendations

Organizations managing high-risk personnel and sensitive enterprise environments should adopt the following mitigations:

• Deploy Mobile Hardening Profiles: Enable Apple Lockdown Mode on all managed devices used by at-risk personnel, which significantly constrains sandbox exploitation and disables high-risk parsers (such as Just-In-Time compilers and complex web fonts).
• Mandate Daily Device Reboots: Force routine daily device restarts to disrupt non-persistent, memory-resident mobile implants.
• Verify Out-of-Band Alerts: Train personnel to validate mobile threat warnings directly against authoritative vendor consoles (e.g., Apple ID / Apple Account portals) rather than unauthenticated communications channels to prevent deceptive social engineering overlays.
• Segregate High-Security Communications: Transition mission-critical and whistleblowing interactions to dedicated hardware decoupled from public-facing persona profiles.