The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, the Citizen Lab said on October 19.
The finding came six days before Serbia’s October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work.
The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing.
The election was called in September after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people.
The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić’s request, working with the Serbian digital-rights group SHARE Foundation. SHARE led the investigation of an earlier wave of Serbian cases made public in September.
A second case concerns Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime who worked on the “Generalštab” corruption investigation into a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27.
Apple sends these alerts when it detects activity consistent with an attack by mercenary spyware, the commercial hacking tools that companies such as NSO sell to governments, and it does not say who is behind the attacks.
The Citizen Lab treats a notification as a high-confidence sign that Bajić’s phone was likely targeted. Its forensic analysis of the device is ongoing, and the note does not say whether the phone was infected.
The Generalštab case concerns the removal of heritage protection from Belgrade’s bombed-out former army General Staff complex to clear the way for a luxury development backed by a company linked to Jared Kushner, U.S. President Donald Trump’s son-in-law.
In December 2025, prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and falsifying documents in the case, the Associated Press reported. Bajić says he was taken off the investigation in November 2025 without explanation, and in February he spoke about the case at a protest called by student activists outside Serbia’s Constitutional Court.
The lab’s note does not say what, if anything, was taken from the rector’s phone. Pegasus gives whoever operates it the same access as the phone’s owner, including private and encrypted messages, and can switch on the microphone and camera without the owner knowing, according to the lab’s analysis of the September case.
Đokić called the spyware on his phone “another attempt of intimidation” in an English-language statement published by the university, and demanded an independent investigation without delay, with its results made public and whoever installed and used the spyware prosecuted. Police raided the rector’s offices on March 31 and seized computers and servers, he said at the time.
The Security Information Agency (BIA), Serbia’s civilian security service, dismissed the September allegations that students and opposition politicians had been spied on as “purely trivial sensationalism” in a statement on September 3, as translated by the broadcaster N1, and said it operates strictly within Serbian law.
The two cases extend a wave that SHARE reported on September 2, when it said at least 14 people in Serbia, including student activists, an opposition MP and a local councilor, had been targeted with spyware since the start of the year. Twelve of them had received Apple Threat Notifications in August, the month Apple warned users in 110 countries.
One was Jelena Kontić, a student whose Pegasus infection the Citizen Lab confirmed. The other two had a new version of NoviSpy, an Android spyware, installed on their phones.
By the Citizen Lab’s count, the two new cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.
Amnesty International reported in December 2024 that NoviSpy was configured to send stolen data to a server whose IP address belonged to the BIA and was installed on activists’ and journalists’ phones during police questioning, after the devices were unlocked with Cellebrite forensic tools.
Lawyers for Kontić filed a criminal complaint on October 6 against unidentified individuals in the BIA and the police, as well as people responsible at NSO Group. Pegasus is sold only to governments and state agencies, SHARE says, and the complaints already filed over spyware in Serbia have brought no effective action.
The note does not name the flaw used against Đokić’s phone or say whether current iOS releases block it, so there is no case-specific fix to install. The lab’s advice for people at risk because of who they are or what they do:
- Turn on Lockdown Mode on your iPhone and keep iOS up to date.
- If you receive an Apple Threat Notification, assume the phone is infected until an expert has checked it, and get help at once: SHARE Foundation in Serbia, or Access Now’s Digital Security Helpline elsewhere.
- Have close contacts, such as family members and people they work with, screened for spyware too.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
