Twelve people came to SHARE Foundation in August after Apple warned them their devices had likely been targeted [3]. Eleven of those phones are still in forensic analysis [7]. Subtract, and one file from that batch is closed [24]: the Pegasus case. Three confirmed infections against at least 14 known targets is roughly one in five [25], and the denominator is still open.
The two NoviSpy cases came in through other doors. One student's phone was infected after authorities took it during police questioning [9]. The second was found because the owner's private messages were read out on a Serbian television network friendly to the ruling party [8]. Amnesty's Donncha O Cearbhaill said the new variant appears to have been updated to avoid detection [10]. In both cases the trigger was an event in the physical world rather than a signature hit.
The two implants differ in what an operator has to arrange. Pegasus reaches a phone with no victim interaction and without the device ever being seized; NoviSpy requires physical access to the handset [13]. Serbia's version of that requirement is already on record. In February 2025, Amnesty reported that Cellebrite had cut ties with the country after documenting police using its extraction tooling to open detainees' phones, never asking for passwords, and then implanting NoviSpy [14]. A month later, Amnesty found two Serbian investigative journalists targeted with Pegasus [15].
Bill Marczak of Citizen Lab said Apple's updates have broken this particular exploit and urged everyone onto the latest iOS [19]. That is the whole of the vendor-side fix available here.
SHARE places the wave in the build-up to March local elections that were read as a test of the ruling Serbian Progressive Party, with student protests that grew after the 2024 Novi Sad railway station canopy collapse [17]. NSO Group says its spyware is for use against terrorism and crime and that it halts any abuses it discovers [21]. Citizen Lab's John Scott-Railton said the company continues to enable authoritarian governments even as Apple threat notifications and forensic research increasingly expose the attacks [22]. The exposure side of that sentence is the operational change worth tracking: a consumer notification, twelve self-referrals and two peer-reviewing labs produced named implants on named devices within about six months.
