The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, according to a report published by the University of Toronto’s Citizen Lab on October 19.
The discovery comes just days before Serbia’s October 25 snap parliamentary election, following nearly two years of protests over government accountability and corruption. According to Citizen Lab, the attack used a zero-click exploit, allowing the spyware to infect Đokić’s iPhone without requiring him to click a link, open a file or take any other action.
Citizen Lab said it had high confidence in its finding after examining forensic evidence from the device at Đokić’s request, working alongside Serbian digital rights organization SHARE Foundation. However, the researchers did not disclose the precise date of the infection or identify who was responsible. The investigation remains ongoing.
The researchers also reported a separate case involving Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić received an Apple threat notification on August 13, followed by a reminder on August 27. Such notifications are issued when Apple detects activity consistent with targeted mercenary spyware attacks, although they do not identify the suspected attacker.
Bajić was involved in the Generalštab corruption investigation concerning a proposed luxury development at Belgrade’s former Yugoslav army headquarters, a site damaged during NATO’s 1999 bombing campaign. The project has been linked to a company associated with Jared Kushner, the son-in-law of US President Donald Trump.
In December 2025, Serbian prosecutors charged Culture Minister Nikola Selaković and three other officials with alleged abuse of office and document falsification in connection with the Generalštab case. Bajić later said he had been removed from the investigation in November 2025 without explanation. The charges and allegations remain matters for the legal process.
Citizen Lab considers Apple’s notification a high-confidence indication that Bajić was likely targeted, but its forensic examination of his device is still underway. The researchers have not confirmed that his phone was infected or that information was stolen.
Pegasus is commercial spyware developed by Israeli company NSO Group and sold to government customers. Once successfully installed, it can potentially provide an operator with access to messages, communications, photographs and other sensitive information. Depending on the device and exploit used, the spyware can also access the microphone and camera.
The latest findings follow an earlier investigation by SHARE Foundation, published on September 2, which reported that at least 14 people in Serbian civil society had been targeted with spyware during 2026. Those affected reportedly included student activists, an opposition member of parliament and a local councillor. The investigation identified both Pegasus and NoviSpy, an Android surveillance tool previously linked by researchers to Serbia’s security apparatus.
Citizen Lab had also confirmed a Pegasus infection affecting student Jelena Kontić. Meanwhile, Amnesty International reported in December 2024 that NoviSpy had been installed on the phones of activists and journalists during police questioning, in some cases after their devices had been unlocked using mobile forensic tools.
Serbia’s Security Information Agency, known as BIA, rejected earlier allegations of spyware use against students and opposition figures in September, describing them as sensationalism and stating that it operates within Serbian law. The agency’s response did not independently establish who was responsible for the latest cases.
Đokić described the spyware discovery as another attempt at intimidation in a statement published by the University of Belgrade. He called for an independent investigation, public disclosure of its findings and prosecution of those responsible. His statement followed a March 31 police raid on the rector’s offices, during which computers and servers were seized.
The two newly reported cases bring the number of people in Serbian civil society publicly identified by Citizen Lab as targeted or infected with mercenary spyware during 2026 to at least 16, according to the researchers’ count.
Citizen Lab has not identified the specific vulnerability used against Đokić’s iPhone or confirmed whether current iOS versions prevent the same attack. For people who may be at risk because of their public role or professional activities, researchers recommend enabling Apple’s Lockdown Mode, installing the latest available security updates and seeking specialist assistance if they receive an Apple threat notification.
People who believe they may have been targeted should avoid assuming that changing a password alone will remove spyware from a compromised device. They can contact SHARE Foundation in Serbia or Access Now’s Digital Security Helpline for assistance with assessing potential compromise.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The investigation remains ongoing, and the available findings do not establish who ordered the alleged surveillance, what information may have been accessed or whether the two cases are connected.
