Pegasus Spyware Found on Phone of Serbian University Rector Ahead of National Elections

The digital forensics research institute the Citizen Lab confirmed on Monday that the phone of University of Belgrade Rector Vladan Đokić was infected with Pegasus spyware sometime this year. Đokić has been a vocal supporter of a student protest movement calling for the permanent removal of former president Aleksandar Vučić from government. The discovery is the latest in a series of such findings before national elections on October 25, in which Vučić is running for prime minister.

A second suspected victim's device is still being analysed. Prosecutor Rade Bajić, who investigated alleged corruption involving a Vučić effort to sell a protected historic building to Jared Kushner, received an Apple threat notification in August, according to Serbia's SHARE Foundation. Apple notifications are widely considered high-confidence indicators of commercial spyware targeting.

According to the SHARE Foundation, it has worked with the Citizen Lab and Amnesty International to find that at least 15 people have been targeted with advanced spyware in 2026. The source says Serbian authorities have used NSO Group's Pegasus against regime opponents for some time, and that the findings raise questions about NSO's assurances that it does not work with repressive governments. NSO Group and the Serbian embassy in Washington did not respond to requests for comment. SHARE researcher Adrijana Ristić described increasing physical and digital repression, including leaked confidential communications and attacks on journalists.