Pegasus Spyware Infection Confirmed on Serbian Rector's iPhone
Citizen Lab confirms zero-click Pegasus infection targeting a prominent Serbian academic before elections.
1Confirmed Pegasus Infection
The Citizen Lab confirmed that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware in 2026. This infection utilized a zero-click exploit, allowing unauthorized access without any user interaction. The discovery occurred just six days before Serbia's snap parliamentary election held on October 25.
2Investigation and Methodology
The forensic analysis was conducted by the University of Toronto's Citizen Lab in collaboration with the Serbian digital-rights group SHARE Foundation. Researchers analyzed forensic artifacts from Đokić's device at his request. While the lab confirmed the infection with high confidence, the specific date of the breach within 2026 remains currently unidentified and under investigation.
3Broader Surveillance Patterns
These cases follow a wider trend reported by the SHARE Foundation on September 2, involving at least 14 targeted individuals in Serbia. Victims include student activists, opposition members, and local officials. Two additional individuals were targeted via NoviSpy, an Android-based spyware, bringing the total number of publicly known targeted civil society members to 16.
4Prosecutorial Associate Targeted
Rade Bajić, a senior associate at the Public Prosecutor's Office for Organized Crime, received Apple Threat Notifications in August 2026. Bajić previously worked on the Generalštab corruption investigation involving a property project linked to Jared Kushner. Although forensic analysis is ongoing, Apple alerts typically indicate activity consistent with state-sponsored mercenary spyware attacks.
5Generalštab Corruption Context
The Generalštab case involves allegations of abuse of office regarding the removal of heritage protection from a former army complex. Prosecutors charged Culture Minister Nikola Selaković and three other officials in December 2025. Bajić reported being removed from this investigation in November 2025, later speaking publicly about the case during student-led protests.
6Spyware Capabilities and Risks
Pegasus provides operators with full access to a device, mirroring the capabilities of the owner. This includes monitoring encrypted messages, activating microphones, and accessing cameras without detection. The Citizen Lab notes that such tools are sold exclusively to governments, posing significant risks to privacy and security for targeted individuals within the civil society.
7Official Responses and Complaints
The Serbian Security Information Agency previously dismissed allegations of surveillance as trivial sensationalism, maintaining that its operations strictly adhere to national law. Conversely, lawyers for student Jelena Kontić filed a criminal complaint on October 6 against unidentified individuals within the BIA and police, citing the lack of effective action following previous spyware reports.
8Security Implications and Outlook
The lack of specific information regarding the exploit used against Đokić means no device-specific patch is currently available. These developments highlight the persistent threat of mercenary spyware against academic and legal figures. Ongoing investigations remain critical to understanding the extent of state surveillance and the potential misuse of forensic tools against domestic political actors.
Original article: The Hacker News — Pegasus Spyware Infection Confirmed on Serbian Rector's iPhone