The spyware story in cybersecurity news today is not a warning about a possible infection. It is a confirmation. Citizen Lab and the SHARE Foundation announced on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus through a zero-click exploit: no tap, no link, no file. Đokić backs the student protest movement that has filled Serbia's streets since late 2024. The announcement landed six days before Serbia's October 25 snap parliamentary election. A second case in the same report is handled differently by the researchers, and the difference between the two is the most useful thing on this page.
A zero-click exploit gives the victim nothing to refuse: 100 percent of the work happens on the attacker's side, inside the code that processes a message before it is even opened. That is why advice built for phishing does not apply here, and why the response below is about device settings and evidence, not about spotting a suspicious link.
Apple's Threat Notifications exist for exactly this pattern. They go to a small number of users Apple believes were individually targeted by state-sponsored attackers, and in the Serbian case the August notifications reached the prosecutor's associate weeks before any public reporting. Read the two cases together and the system becomes clear: the notification is the early warning, the forensic analysis is the confirmation, and the gap between them is where the right actions live. Wiping the phone in that gap destroys the evidence. Ignoring the notification wastes the warning. The check below sorts out which situation you are in.
Three answers. Everything runs in your browser; nothing is sent anywhere.
BreachHunter — Ingenious AI's intrusion and breach-signal hunter — covers the wider pattern these cases sit inside: aimed intrusions leave signals before they leave headlines, and watching for them is a discipline, not a hope. Get early access on WhatsApp.
1. Whose iPhone was confirmed infected with Pegasus?
2. How did the infection reach his phone?
3. What is established in the prosecutor's associate's case?
4. How many people in Serbia are now publicly identified as targeted or infected?
5. What timing surrounds the announcement?
The Pegasus Serbia case is the October 2026 confirmation by Citizen Lab and the SHARE Foundation that NSO Group's Pegasus spyware infected the iPhone of Vladan Đokić, rector of the University of Belgrade, through a zero-click exploit. A second official, prosecutor's associate Rade Bajić, received Apple threat notifications in August; researchers treat that as likely targeting, with his infection not confirmed.
No. It means Apple believes you were targeted by a state-sponsored attacker, which is a different claim from a confirmed infection. Citizen Lab treats these notifications as a high-confidence sign of likely targeting. Infection itself is established by forensic analysis of the device, which is why the Serbian prosecutor's associate is described as targeted while his case is still being examined. A notification is still an instruction to act: turn on Lockdown Mode, update the phone, and get expert help.
Through zero-click exploits: flaws in the code that processes incoming messages, images or calls, which run when the content arrives, before the owner opens anything. There is no link to avoid and no attachment to refuse, which is what separates mercenary spyware from ordinary phishing. The defenses are structural: install system updates promptly, since each one closes known exploit paths, and use Lockdown Mode, which shrinks the attack surface by restricting message attachments, link previews and other features these exploits abuse.
People whose work draws the attention of a state or a state client: officials, prosecutors, journalists, lawyers, academics and activists in public disputes. The Serbian cases fit that shape: a university rector backing a protest movement and a prosecutorial associate working a corruption investigation tied to a politically sensitive property project. With these two, at least 16 people in Serbia are publicly identified as targeted or infected. This is not a mass-consumer threat; it is aimed, one person at a time, which is why the per-person response matters.
Treat it as real. Turn on Lockdown Mode and update iOS the same day. Do not wipe or factory-reset the phone before getting forensic advice, because the device carries the evidence that confirms what happened. Contact a digital security helpline such as Access Now's, which handles exactly these cases. Move sensitive accounts and conversations to a clean device and change passwords from that device, not from the phone that may be compromised. Then follow the steps in the check on this page.
Sources: The Hacker News, October 2026, reporting the Citizen Lab and SHARE Foundation findings (the confirmed Đokić infection, the zero-click method, the Bajić notifications of August 13 and 27, the count of at least 16, and the October 25 election timing). Where the research distinguishes confirmed infection from likely targeting, this page keeps that distinction.