DAILY BRIEFING
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
Today's briefing covers zero-click Pegasus spyware targeting a Serbian academic and hidden prompt instructions uncovered across WhatsApp help pages.
5 stories2 min read
Forensic analysis revealed a zero-click Pegasus spyware infection on the iPhone of Vladan Đokić, rector of the University of Belgrade, ahead of Serbia's parliamentary election. The incident highlights the persistent risk posed by commercial surveillance tools against high-profile civic figures.
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
Citizen Lab confirmed that the iPhone of Serbian university rector Vladan Đokić was infected with NSO Group Pegasus spyware in 2026 using a zero-click exploit, days before Serbia's snap election.
- Why it matters
- High-profile targets face sophisticated mobile surveillance threats where zero-click exploits enable stealthy compromise without user interaction.
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
Redact found 102 hidden HTML instruction blocks across 80 WhatsApp help pages directing its AI chatbot to avoid referring users to privacy regulators or interpreting laws like GDPR. Meta removed the text following media inquiries.
- Why it matters
- Organizations using AI chatbots integrated with public web documentation risk suppressing regulatory rights or outputting biased guidance based on hidden system prompts.
- What to do
- Review AI knowledge base sources and web inputs for unverified instructions or prompt overrides.
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance.
Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019.
- Why it matters
- The underlying story content could not be processed due to perimeter bot controls.
Windows Server 2025 gets support for quick machine recovery
The Bleeping Computer article content could not be retrieved because of an active Cloudflare bot verification check.
Key takeaways
- Citizen Lab confirmed a zero-click Pegasus spyware infection on an iPhone belonging to University of Belgrade rector Vladan Đokić.
- Redact discovered 102 hidden prompt directives embedded across 80 WhatsApp help center pages.
- WhatsApp hidden HTML prompts instructed its AI chatbot not to recommend data protection authorities or interpret privacy laws like GDPR.