Zero-Click Surveillance: NSO Group's Pegasus Spyware Targets Serbian Civil Society via iMessage Exploit Chain
Executive Summary
A joint investigative report released by Citizen Lab, Amnesty International, and Serbia's Share Foundation has revealed that iPhones belonging to members of Serbia's civil society and student protest movement were infected with NSO Group's notorious Pegasus mercenary spyware. The forensic investigation confirmed infections occurring between December 2025 and 2026, documenting at least 14 targeted individuals in Serbia who faced sophisticated surveillance attacks. The attackers weaponized a zero-click exploit chain delivered directly via Apple iMessage, requiring absolutely zero user interaction from the victims. Once active on a device, Pegasus grants remote state-backed operators unfettered access to encrypted communications, microphone recordings, camera streams, and real-time geolocation.
Deep-Dive Technical Analysis
The investigation details an advanced, multi-stage zero-click exploit chain capable of compromising fully updated iOS devices without alerting the user.
The Zero-Click iMessage Attack Vector
The intrusion begins when an attacker-controlled Apple ID transmits specially crafted iMessage data packets to the victim's phone number or iCloud address:
* Silent Background Processing: Unlike traditional phishing lures that rely on users clicking malicious hyperlinks, modern iMessage zero-clicks exploit background daemons (such as IMTranscoderAgent and components within the BlastDoor sandbox framework) that automatically process, parse, and generate image/media previews upon message arrival.
* Format Parsing Flaw: The exploit triggers an integer overflow or out-of-bounds heap memory corruption during the decoding of malformed image files (e.g., JBIG2, TIFF, or PassKit package descriptors).
* Sandbox Escape: After securing arbitrary code execution inside BlastDoor, the exploit chain leverages a secondary local privilege escalation vulnerability within the XNU kernel or an IOKit graphics driver. By manipulating kernel memory descriptors and bypassing Kernel Address Space Layout Randomization (KASLR) alongside Apple's Page Protection Layer (PPL), the exploit elevates privileges directly to root/kernel level.
Pegasus Spyware Capabilities & In-Memory Operation
Upon establishing root execution, the Pegasus loader executes silently:
* Process Injection: Pegasus injects dynamic libraries into legitimate iOS system processes (such as mediaserverd, commcenter, and springboard), ensuring it operates without creating anomalous standalone binaries on disk.
* Complete Data Exfiltration: The spyware bypasses end-to-end encryption protocols by capturing chat messages directly from memory buffers in applications including Signal, WhatsApp, Telegram, and Apple Messages before encryption or after decryption occurs.
* Active Sensor Surveillance: Operators can remotely activate the device's microphone and camera hardware to monitor meetings and private conversations in real time, record ambient audio, extract call logs, intercept SMS messages, and track continuous GPS coordinates.
* Anti-Forensics: Pegasus operates primarily in volatile memory (RAM). When an infected device is powered off or rebooted, the core in-memory implant is purged; however, threat actors frequently re-infect the device via subsequent zero-click messages once the target reconnects to cellular networks.
Industry Impact
The confirmed deployment of Pegasus against student activists and civil society in Europe underscores several critical cybersecurity realities:
* Commercial Spyware Market Proliferation: Despite international sanctions, export controls, and legal actions, commercial surveillance vendors continue to discover and weaponize high-value zero-click vulnerabilities against high-profile targets.
* Threat Beyond Activists: While civil society often serves as the testing ground, identical zero-click exploit chains are regularly deployed against corporate executives, legal counsel, financial institutions, and government officials worldwide.
* Limits of User Training: Traditional security awareness training (such as "do not click suspicious links") is completely powerless against zero-click vectors, shifting the security burden entirely to platform hardening and architectural isolation.
Recommendations & Mitigations
Security leaders, enterprise administrators, and high-risk individuals should implement the following hardening measures:
1. Enable Apple Lockdown Mode: For any individual facing elevated threat profiles (executives, board members, investigative journalists, legal teams), enable iOS Lockdown Mode (Settings > Privacy & Security > Lockdown Mode). Lockdown Mode severely restricts message parsing, blocks complex media attachments, and disables untrusted web fonts and JIT engines, successfully thwarting known Pegasus zero-click chains.
2. Implement Daily Device Reboots: Because Pegasus often maintains a non-persistent, memory-only presence to evade disk forensics, daily device reboots force the malware out of memory. This disrupts ongoing surveillance sessions and compels operators to risk re-infection attempts that leave detectable forensic traces.
3. Keep iOS Devices Up-to-Date: Regularly install all Apple Rapid Security Responses and point releases (e.g., iOS 26.6.1), which continuously patch newly identified memory corruption flaws in image parsers and WebKit.
4. Run Forensic Audits with MVT: Organizations should utilize tools such as Amnesty International's Mobile Verification Toolkit (MVT) to regularly inspect iOS sysdiagnose dumps for known indicators of compromise (IOCs), anomalous process crashes, and rogue certificates.
5. Minimize iMessage and FaceTime Exposure: High-risk personnel should consider unlinking phone numbers from iMessage and FaceTime, or utilizing dedicated, secure secondary communication devices for sensitive discussions.