- summary
- On or about 16 August 2023, the iPhones of two Serbian civil society members were targeted roughly one minute apart using the iOS HomeKit functionality. On 30 October 2023 both received Apple threat notifications warning of state-sponsored attacks. SHARE Foundation, Access Now's Digital Security Helpline and Amnesty International's Security Lab examined the devices: the forensic traces were consistent with techniques previously used to deliver NSO Group's Pegasus spyware, and the attack attempts did not succeed (Amnesty, 28 November 2023). Amnesty later described these as Pegasus attack attempts (March 2025). Amnesty also reported evidence that Pegasus had been used against other Serbian civil society members in the same period.
- country
- Serbia
- date text
- 16/08/2023
- entities
- Unattributed state-sponsored operator (Apple threat notification); Pegasus is sold only to government clients
- entity type
- Security Apparatus (suspected, unattributed)
- id
- 1149
- name
- Unattributed state-sponsored operator (Apple threat notification); Pegasus is sold only to government clients
- role
- actor
- Two members of Serbian civil society, both openly critical of the government (names withheld)
- entity type
- Individual — Activist
- id
- 1150
- name
- Two members of Serbian civil society, both openly critical of the government (names withheld)
- role
- target
- Unattributed state-sponsored operator (Apple threat notification); Pegasus is sold only to government clients
- sources
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Surveillance Infrastructure / Spyware Deployment
- campaign ids
- channels
- Zero-click spyware attack attempt via iOS HomeKit (Pegasus-consistent)
- civic response
- After the Apple threat notifications (30 Oct 2023), SHARE Foundation coordinated independent forensic checks with Access Now's Digital Security Helpline and Amnesty International's Security Lab, and the findings were published (28 Nov 2023) with calls to ban highly invasive spyware.
- consequence category
- Operational Suppression
- created at
- 2026-09-25T12:58:47.777562+00:00
- date precision
- day
- escalation
- 4
- harm track
- Track 3 — Operational Suppression
- id
- SRB-123
- institutional consequence
- Chilling effect
- notes
- Coded Sep 25 2026. Earliest documented Pegasus targeting of Serbian civil society in the database; precursor of SRB-124 (2025) and SRB-121 (2026). Campaign SRB-CAMP-018 (label currently reads 2024–2026). Context: Amnesty's 'Inside Pegasus' (16 Jul 2026) notes that each Pegasus customer has its own attack infrastructure, which is how repeated Serbian-language infection domains link cases. Escalation 4: state-sponsored threat notifications (Apple, 30 Oct 2023); infection not confirmed. (Spyware thresholds, Sep 25 2026.) UN Special Rapporteurs (15 Sep 2026) cite Pegasus, NoviSpy and Cellebrite UFED together as confirming 'a pattern of unlawful surveillance and intimidation' in Serbia (CR-SRB-003); pattern: SRB-123 (2023), SRB-122 (2024), SRB-124 (2025), SRB-121 (2025–26).
- occurred on
- 2023-08-16
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T14:48:22.988932+00:00
- version
- 2
The public research collection