Zero-click means the target does nothing. The message lands and the exploit runs, so the only device-side defense is that the bug has already been fixed. In this case it had been. Citizen Lab assesses the iMessage flaw was addressed in iOS 18.4.1, which Apple shipped in April 2025 [3], while the high-confidence infection indicators begin in December 2025 [2]. That is roughly eight months between fix and earliest confirmed infection, nine to the January 2026 end of the window [14].
The findings as reported tie the exploit to a version rather than to a CVE [16]. There is nothing to match against a vendor advisory or a KEV entry, so the only check available to someone triaging a high-risk fleet is the OS version itself.
The second Serbian case takes patching out of the argument. A student movement member's Android phone was confiscated during police questioning and came back carrying a new build of NoviSpy [7]. Donncha O Cearbhaill, head of Amnesty International's Security Lab, said the forensic findings show these tools being installed while students are in detention [8], and that the 2026 strain was built with specific effort to avoid detection by researchers [9]. It was found anyway on a second device, for a reason no lab designed: private Viber messages from that phone were read out live on Informer TV, a pro-government Serbian channel [10].
SHARE Foundation counts at least 14 people targeted since the start of 2026, including activists, a member of parliament and an opposition local councilor [5], with the timing tracking the 29 March 2026 local elections [6]. Apple's latest mercenary-spyware notifications went to an unspecified number of users across 110 countries [4], which sets breadth without a denominator. The named mitigations are configuration rather than procurement: device updates and Lockdown Mode on iOS, Google's Advanced Protection Program [12], WhatsApp's Strict Account Settings blocking media from non-contacts [13]. The bill is lost functionality, paid by the user.
Serbia's record already included Cellebrite forensic unlocks used to plant NoviSpy [11]. The 2026 cases keep that method, harden the Android implant against detection, and add a remote iOS chain on top [15]. That reads as one operator maintaining a toolkit across two platforms.
