Pegasus Zero-Click Spyware Confirmed on Serbian Rector's iPhone: iOS Detection, Forensics, and Hardening Guide

On October 19, 2026, Citizen Lab confirmed that the iPhone of Vladan Đokić — rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement — was infected with NSO Group's Pegasus spyware. The confirmation landed six days before Serbia's October 25 snap parliamentary election, a timing that strongly suggests the surveillance was politically motivated rather than criminal. Critically, the infection leveraged a zero-click exploit: Đokić never tapped a link, opened an attachment, or took any action at all. The device was compromised silently.

This is not an isolated incident — it is the latest entry in a years-long pattern of Pegasus being deployed against journalists, opposition figures, academics, and civil society actors across Europe and beyond. For defenders, the lesson is stark: mercenary spyware defeats user-awareness training by design. If your organization employs executives, diplomats, researchers, journalists, lawyers, or activists, you must assume targeted zero-click compromise is in scope for your threat model and build detection and response capability accordingly.

Technical Analysis

What We Know About This Infection

Target platform: Apple iOS (iPhone)
Spyware family: Pegasus, developed by NSO Group (Israel)
Delivery mechanism: Zero-click exploit — historically delivered via iMessage, FaceTime, WhatsApp, and Apple services such as HomeKit and Find My. No user interaction required.
Attribution: Confirmed by Citizen Lab's forensic methodology, which remains the gold standard for mercenary spyware attribution
Context: Politically timed targeting of a civil society figure ahead of a national election

No CVE identifier has been publicly disclosed for the exploit chain used in this infection, which is typical — NSO Group chains are often burned and patched silently, with CVEs assigned months later (if at all). Do not wait for a CVE to act. The exploitation status here is confirmed active, in-the-wild exploitation against a real target, which places this firmly in CISA KEV-adjacent territory for prioritization purposes regardless of identifier availability.

How Zero-Click Pegasus Infections Work (Defender's View)

Zero-click chains against iOS typically follow this pattern:

Delivery: A malicious message or call is pushed to the device through a dataless channel — iMessage attachments, FaceTime call setup, or SMS-carried payloads processed by baseband or parsing daemons.
Exploitation: A vulnerability in a parsing component (BlastDoor bypasses, WebKit, image/font renderers, or iMessage's IMDPersistenceAgent) achieves arbitrary code execution inside a sandboxed process.
Privilege escalation: A kernel or PAC/zone-restriction bypass breaks out to root.
Persistence-adjacent staging: Pegasus historically does not survive reboot in its classic form; instead it reinfects or operates resident, leaving forensic traces in system databases.
Exfiltration: Messages, calls, microphone/camera activation, keychain contents, and app data (WhatsApp, Signal, Telegram) are exfiltrated over encrypted channels to operator infrastructure, often using domain fronting or fast-flux C2.

Forensic Artifacts That Survive

The reason Citizen Lab and Amnesty's Mobile Verification Toolkit (MVT) can confirm these infections is that Pegasus leaves reproducible traces even after self-cleanup:

DataUsage.sqlite — records process names (e.g., suspicious entries like msgaccesd, roleaccountd, or processes masquerading as legitimate daemons) with network activity timestamps
netusage.sqlite — similar per-process network accounting
iMessage/SMS artifacts — anomalous message records with no corresponding user-visible content, often linked to attacker-controlled email addresses or phone numbers
shutdown.log / sysdiagnose logs — evidence of processes running at unexpected times
Safari Favicon cache and browser history fragments — from redirect-based one-click variants
Process execution traces in powerlog databases

Why This Matters Beyond One Rector

If Pegasus is being deployed in Serbia ahead of an election, the operator (a government customer of NSO Group, per NSO's own licensing model) is almost certainly targeting dozens to hundreds of devices: opposition members, journalists, election monitors, NGO staff, and academics. Organizations operating in or with staff traveling to affected regions should treat this as an active campaign, not a single event.

Detection & Response

Mercenary spyware detection operates at three layers: on-device forensics (the authoritative method), network telemetry (proxy/firewall/DNS), and fleet posture management (MDM signals like missing Lockdown Mode or delayed patching). The detections below address each layer.

Sigma Rules — Network Layer

These rules target behaviors consistent with Pegasus C2 and exploit delivery observable in enterprise proxy, DNS, and firewall logs. Tune the mobile-subnet scoping to your environment.

YAML

---
title: High-Entropy Subdomain DNS Query from Mobile Device Subnet
description: Detects DNS queries with unusually long, high-entropy subdomain labels originating from mobile/ BYOD subnets, a pattern consistent with mercenary spyware C2 domain generation and domain-fronting behavior observed in Pegasus operations.
references:
  - https://citizenlab.ca/
  - https://thehackernews.com/2026/10/pegasus-spyware-infection-confirmed-on.html
author: Security Arsenal
date: 2026/10/20
status: experimental
logsource:
  category: dns
detection:
  selection:
    query|re: '^[a-z0-9]{24,}\.[a-z0-9\-]+\.(com|net|org|info|cc|cloud)$'
  filter_known_cdn:
    query|contains:
      - 'akamai'
      - 'cloudfront'
      - 'azure'
      - 'apple.com'
      - 'icloud.com'
  condition: selection and not filter_known_cdn
falsepositives:
  - CDN and DGA-like legitimate services; scope to BYOD/mobile VLANs and tune per-environment
level: medium
---
title: TLS Connection to Rare Domain from Mobile Device Without Prior DNS History
description: Detects outbound TLS sessions from mobile device subnets to domains with no organizational browsing history, consistent with spyware exfiltration to operator-controlled infrastructure. Pegasus historically uses freshly registered or low-reputation domains with short-lived certificates.
references:
  - https://thehackernews.com/2026/10/pegasus-spyware-infection-confirmed-on.html
author: Security Arsenal
date: 2026/10/20
status: experimental
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains:
      - 'iPhone'
      - 'iOS'
    r-dns|re: '^([a-z0-9\-]+\.){1,2}(com|net|info|xyz|cc|cloud|shop)$'
  condition: selection
falsepositives:
  - Legitimate first-visit browsing; enrich with domain age/reputation feeds and alert only on newly-registered (<90 days) domains
level: low

KQL — Microsoft Sentinel

This query hunts for mobile devices on corporate Wi-Fi/VPN establishing sessions to rare, newly observed domains — a practical proxy for spyware exfiltration when you cannot instrument the device itself. It assumes firewall/proxy data ingested via CEF into CommonSecurityLog.

KQL — Microsoft Sentinel / Defender

// Hunt: rare-domain egress from mobile device subnets (potential spyware C2)
let lookback = 14d;
let known_domains =
    CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where isnotempty(DestinationHostName)
    | summarize count() by DestinationHostName
    | where count_ > 50
    | project DestinationHostName;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(DestinationHostName)
| where DestinationHostName matches regex @"^[a-z0-9\-]+\.(com|net|info|xyz|cc|cloud|shop)$"
| where DestinationHostName !in (known_domains)
| where SourceIP startswith "10.50." or SourceIP startswith "192.168.50." // scope to BYOD/mobile VLANs
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            BytesSent=sum(tolong(SentBytes)), Sessions=count()
  by SourceIP, DestinationHostName, DestinationPort
| where BytesSent > 500000 or Sessions > 100  // sustained exfil or beaconing volume
| order by BytesSent desc

Velociraptor VQL — iOS Backup Forensics on Managed Workstations

Velociraptor cannot run on iOS, but it can hunt managed Windows/macOS workstations for iOS backups containing known Pegasus process-name artifacts — the same indicators MVT checks. This is how you sweep a fleet for compromised executives without touching their phones first.

VQL — Velociraptor

-- Hunt iOS backups on endpoints for Pegasus process-name artifacts
-- Mirrors MVT indicators: anomalous process names found in DataUsage records

LET backup_paths = SELECT FullPath FROM glob(
  globs=[
    'C:/Users/*/Apple/MobileSync/Backup/*',
    'C:/Users/*/AppData/Roaming/Apple Computer/MobileSync/Backup/*',
    '/Users/*/Library/Application Support/MobileSync/Backup/*'
  ])

SELECT FullPath AS BackupDirectory,
       ModTime AS LastModified,
       'Potential iOS backup located - acquire and run mvt-ios check-backup for Pegasus IOC sweep' AS Recommendation
FROM backup_paths

Remediation & Collection Script

Use this on a macOS/Linux analysis workstation to acquire a sysdiagnose/backup from a suspected device and run MVT against it. This is the same methodology Citizen Lab's confirmations rest on.

Bash / Shell

#!/bin/bash
# Pegasus forensic triage - run on analysis workstation, never on the target device
set -euo pipefail

CASE_ID="${1:?Usage: $0 <case_id> <path_to_backup_or_dump>}"
EVIDENCE_SRC="${2:?Provide path to decrypted iOS backup or filesystem dump}"
WORK="/cases/${CASE_ID}"
mkdir -p "${WORK}"

# 1. Hash the evidence before touching it
find "${EVIDENCE_SRC}" -type f -exec shasum -a 256 {} \; > "${WORK}/evidence_hashes.txt"

# 2. Ensure MVT is current (indicators update frequently)
pip3 install --upgrade mvt

# 3. Pull latest community Pegasus IOCs (Amnesty/Citizen Lab STIX2)
mvt-ios download-iocs --output "${WORK}/iocs"

# 4. Scan the backup/filesystem dump
mvt-ios check-backup --iocs "${WORK}/iocs" --output "${WORK}/results" "${EVIDENCE_SRC}" || \
mvt-ios check-fs    --iocs "${WORK}/iocs" --output "${WORK}/results" "${EVIDENCE_SRC}"

# 5. Extract flagged artifacts for reporting
grep -l -i -E 'pegasus|nso|msgaccesd|roleaccountd|FRITZ|Bh' "${WORK}/results"/*.json 2>/dev/null \
  | tee "${WORK}/positive_hits.txt"

echo "[+] Triage complete. Results in ${WORK}/results"
echo "[!] Positive hits require expert validation before attribution - contact Citizen Lab or a specialist IR firm"

Remediation and Hardening

There is no patch to deploy for an undisclosed zero-click chain. Your defense is attack surface reduction, detection capability, and rapid response. Prioritize in this order:

For At-Risk Individuals (Executives, Journalists, Activists, Government-Critical Staff)

Enable iOS Lockdown Mode immediately — Settings → Privacy & Security → Lockdown Mode. Apple designed this specifically to blunt mercenary spyware: it blocks most iMessage attachment types, disables link previews, restricts FaceTime calls from unknown contacts, and limits web technologies commonly used in exploit chains. Citizen Lab cases have documented Lockdown Mode actively blocking Pegasus delivery attempts.
Keep iOS on the latest release, no exceptions. NSO chains are burned by Apple updates; every day on an old build is a day the operator's existing toolkit still works. Enable automatic updates and verify via MDM compliance.
Reboot daily. Classic Pegasus persistence does not survive reboot. A daily reboot forces reinfection, increasing the chance of catching delivery artifacts and degrading the operator's dwell time.
Disable iMessage and FaceTime for the highest-risk individuals if operationally tolerable — these remain the most exploited zero-click delivery channels.
Use a separate device for sensitive communications, preferably one that has never been enrolled in personal accounts or exposed to untrusted contacts.

For the Organization

Enroll all executive devices in MDM with compliance policies enforcing: current iOS version, Lockdown Mode status reporting where feasible, passcode complexity, and no jailbreak indicators.
Onboard Apple threat notifications. If Apple emails a user that they may be targeted by state-sponsored attackers, treat it as a confirmed incident — Apple's notification program has preceded multiple verified Pegasus confirmations.
Establish an iOS forensics runbook now: sysdiagnose capture procedure, encrypted backup acquisition, MVT workflow, evidence handling, and an external escalation path (Citizen Lab, Access Now's Digital Security Helpline, Amnesty Security Lab, or a specialist IR retainer).
Route BYOD/mobile traffic through inspectable egress (VPN or per-app VPN through your proxy) so the network-layer detections above have visibility. Without this, mobile exfiltration is invisible to you.
Threat-model your people, not just your perimeter. If your staff includes figures of political, journalistic, or intelligence interest, mercenary spyware is a top-tier threat and deserves board-level risk treatment.

If Infection Is Suspected

Do not wipe the device. Preserve forensic evidence first; wiping destroys the very artifacts needed for confirmation and attribution.
Capture sysdiagnose and an encrypted backup, hash everything, and run MVT per the script above.
Report to Apple (through enterprise support channels) and to Citizen Lab's research team, which actively tracks NSO deployments globally and can validate findings.
Treat all communications from the device as compromised from the earliest suspected infection date — rotate credentials, review accessed data, and scope downstream impact.

The Bottom Line

The infection of Vladan Đokić's iPhone is a reminder that the world's most sophisticated surveillance tooling is a commercial product available to any government willing to pay, and it is being aimed at people whose only "offense" is civic engagement. You cannot train users out of a zero-click. You can, however, harden devices with Lockdown Mode, instrument your network for the traffic spyware must generate, and build the forensic muscle to confirm and respond when — not if — one of your people is targeted.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub