Pegasus Spyware Found on Belgrade University Rector's iPhone Days Before Serbian Election

The Citizen Lab, a research group at the University of Toronto, said on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The infection used a zero-click exploit, meaning he did not need to tap a link or open a file. The lab found the infection with high confidence, but it gave no date within 2026, did not say who was behind the attack, and noted its investigation is ongoing. The finding came six days before Serbia's October 25 snap parliamentary election.

A second case involves Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption investigation. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends these alerts when it detects activity consistent with mercenary spyware, the commercial hacking tools sold to governments, and it does not say who is responsible. The Citizen Lab treats the notification as a high-confidence sign his phone was likely targeted. Its forensic analysis continues, and it has not said whether the phone was infected.

The Citizen Lab examined Đokić's phone at his request, working with the Serbian digital-rights group SHARE Foundation, which also led an earlier wave of Serbian cases made public in September.