Pegasus Spyware Found on Devices of Prominent Serbian Critics, Researchers Say

Researchers have detected spyware on devices used by some of Serbia's most prominent figures connected to the country's political upheaval. The SHARE Foundation, a Serbian digital rights group, and The Citizen Lab at the University of Toronto announced the findings on Monday. Those targeted include Vladan Đokić, rector of the University of Belgrade and a prominent figure in the student protest movement, and Rade Bajić, a lawyer with Serbia's Public Prosecutor's Office for Organized Crime.

The cases follow what the SHARE Foundation described in September as the largest documented wave of spyware surveillance in Serbia. That wave involved 14 people, including a member of parliament and a local government official, who were targeted with Pegasus and a new version of the NoviSpy Android spyware. SHARE researcher Andrijana Ristić said this is the second confirmed Pegasus infection in Serbia this year. She declined to say when it was discovered, citing the sensitivity of the investigation.

The SHARE Foundation carried out the first forensic analysis, and The Citizen Lab then confirmed the result. The lab said it found with high confidence that the device was infected with NSO Group's Pegasus spyware in 2026. It said the infection used a zero-click exploit, meaning no action such as clicking a link or opening a file was needed. Đokić was unavailable for comment.