Pegasus Spyware Targeted Serbian University Rector Before Snap Elections
Citizen Lab confirms zero-click infection of Vladan Đokić's iPhone amid political tensions.
1Confirmed Pegasus Infection
Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware in 2026. The infection utilized a zero-click exploit, requiring no user interaction. This incident marks a significant escalation in the surveillance of Serbian civil society figures.
2Strategic Election Timing
The discovery occurred just six days before Serbia's snap parliamentary elections on October 25. Đokić, a prominent supporter of the student-led pro-democracy movement, had previously faced office raids on March 31. Pro-government media outlets have repeatedly targeted him since he refused to facilitate a government crackdown on student protesters earlier that year.
3Capabilities of Pegasus
Once installed via zero-click methods, Pegasus grants operators full access to the target's device. This includes reading encrypted messages, accessing private files, and covertly activating the microphone or camera. Such capabilities allow for total surveillance of the victim's communications, effectively turning a personal smartphone into a powerful tool for state-level intelligence gathering.
4Prosecutor Targeted Separately
Rade Bajić, a senior prosecutor who investigated corruption in the Generalštab case, received multiple Apple Threat Notifications in August 2026. Bajić was removed from his investigation into a luxury development project linked to Jared Kushner in November 2025. Forensic analysis of his device remains ongoing, though these notifications indicate a high-confidence targeting attempt.
5Broader Pattern of Attacks
These incidents bring the total number of known Serbian civil society members targeted by commercial spyware to at least 16. Previous waves of attacks, documented by the SHARE Foundation and Amnesty International, affected student protesters and opposition figures during the lead-up to local elections in March. The trend suggests a systematic surveillance campaign.
6Official Response and Denial
Serbian security services have dismissed previous reports regarding spyware usage as trivial sensationalism. They maintain that all their operations are conducted within the boundaries of Serbian law. Despite these denials, the exclusive nature of Pegasus, which is sold only to government agencies, limits the pool of potential operators behind these specific digital intrusions.
7Victim's Call for Justice
Vladan Đokić has publicly characterized the spyware infection as an act of intimidation. He is demanding an independent investigation into the breach, the public disclosure of all findings, and the criminal prosecution of those responsible for the attack. His stance highlights the growing friction between academic leadership and state surveillance apparatuses.
8Digital Security Recommendations
Experts advise users who receive Apple Threat Notifications to treat their devices as compromised until verified by professionals. Recommended defensive measures include enabling Lockdown Mode, maintaining updated iOS versions, and seeking assistance from organizations like the SHARE Foundation or Access Now. Vigilance is essential for journalists, activists, and human rights defenders globally.