The iPhone belonging to Vladan Đokić, the rector of the University of Belgrade and a prominent figure supporting Serbia’s student protest movement, was infected with NSO Group’s high-grade Pegasus spyware in 2026, according to findings released by the Citizen Lab on October 19. The disturbing digital security discovery came to light just six days before Serbia’s scheduled October 25 snap parliamentary election, intensifying a growing crisis over the alleged state-sponsored surveillance of civil society figures, academics, and legal professionals.
According to researchers, the infection utilized a zero-click exploit, meaning that Đokić was not required to click a malicious link, open an infected attachment, or take any interactive steps for the intrusion to succeed. While the Citizen Lab stated it had high confidence in its forensic conclusions regarding the presence of the military-grade spyware, its preliminary advisory did not specify an exact date within 2026 for the attack, nor did it definitively attribute the operation to a specific perpetrator, noting that forensic investigations into the breach remain ongoing.
The snap parliamentary vote was called in September following nearly two years of sustained public unrest across the Balkan nation. The demonstrations originally erupted in November 2024 after a tragic railway station canopy collapse in the city of Novi Sad killed 16 people, igniting widespread public anger over alleged governmental corruption, negligence, and institutional decay.
The Citizen Lab, an interdisciplinary cybersecurity and public policy research group based at the University of Toronto, analyzed forensic artifacts recovered from the rector’s mobile device at Đokić’s direct request. In doing so, the researchers collaborated closely with the SHARE Foundation, a prominent Serbian digital-rights organization that previously spearheaded investigations into an earlier wave of cyberespionage cases made public in September.
The unfolding scandal also involves a second high-profile target: Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić previously worked on the sensitive "Generalštab" corruption investigation concerning a controversial, Kushner-linked property redevelopment project in downtown Belgrade. Bajić received official Apple Threat Notifications on August 13, followed by a security reminder on August 27.
Apple issues these automated threat alerts when its internal telemetry detects activity consistent with targeted attacks by mercenary spyware—commercial hacking tools developed by private firms such as Israel-based NSO Group and sold exclusively to government agencies and state intelligence bodies. In line with standard protocol, Apple’s notifications do not publicly name the specific entities or government actors behind the malicious campaigns.
The Citizen Lab treats Apple Threat Notifications as high-confidence indicators that a device was likely targeted for compromise. Although forensic analysis of Bajić’s smartphone is still ongoing, the research group’s public notes have not yet confirmed whether the device suffered a successful full system infection.
The underlying Generalštab case centers on the controversial removal of heritage protection status from Belgrade’s heavily bombed-out former army General Staff complex. The administrative maneuver was designed to clear the path for a luxury commercial real estate development backed by a corporate entity connected to Jared Kushner, the son-in-law of U.S. President Donald Trump.
In December 2025, Serbian anti-corruption prosecutors formally charged Culture Minister Nikola Selaković alongside three other government officials with abuse of office and the falsification of official documents in connection with the real estate project, as reported by the Associated Press. Bajić has publicly stated that he was abruptly removed from the investigation in November 2025 without receiving any formal explanation. By February, he spoke openly about the political interference surrounding the case during a public protest organized by student activists outside Serbia’s Constitutional Court.
While the Citizen Lab’s preliminary findings regarding Rector Đokić do not specify whether personal data, communications, or documents were exfiltrated from his device, commercial spyware of the caliber of Pegasus grants its operator deep, systemic access to a compromised smartphone. According to technical analyses of previous cases, successful Pegasus deployments provide the attacker with capabilities equivalent to physical possession of the phone. This includes reading private and encrypted messaging applications, monitoring real-time communications, and remotely activating the device’s internal microphone and camera without the owner’s knowledge or consent.
In an official English-language statement published by the University of Belgrade, Đokić characterized the discovery of spyware on his phone as "another attempt of intimidation" directed at the academic community and the broader pro-democracy movement. He demanded the immediate launch of an independent, transparent investigation, insisting that the findings be made public and that any individuals responsible for installing and operating the surveillance software be prosecuted under the law. The rector previously reported that Serbian police raided his official university offices on March 31, seizing various computers and servers during the operation.
In response to earlier allegations, the Security Information Agency (BIA), Serbia’s civilian intelligence and security service, dismissed September’s public reports regarding the targeting of students and opposition politicians as "purely trivial sensationalism." In an official statement translated by regional broadcaster N1, the agency asserted that it operates strictly within the confines of Serbian law and respects all constitutional boundaries.
The identification of infections affecting Đokić and Bajić significantly expands an alarming wave of digital surveillance first highlighted by the SHARE Foundation on September 2. At that time, the digital rights group reported that at least 14 individuals across Serbia—including student activists, an opposition member of parliament, and a local councilor—had been targeted with sophisticated spyware since the beginning of the year. Twelve of those individuals received Apple Threat Notifications in August, coinciding with a mass warning issued by Apple to users across 110 countries.
Among those victims was Jelena Kontić, a student activist whose Pegasus infection was independently verified by the Citizen Lab. Two other civil society members were found to have been targeted with NoviSpy, a specialized variant of Android spyware.
With the addition of the rector and the prosecutorial associate, the total number of individuals within Serbian civil society publicly confirmed to have been targeted or infected with mercenary spyware this year has risen to at least 16.
Previous research published by Amnesty International in December 2024 revealed that NoviSpy was engineered to route stolen personal data to external servers whose IP addresses were traced back to infrastructure associated with the BIA. According to civil society reports, instances of NoviSpy installation often occurred while activists and journalists were undergoing police questioning, typically after their mobile devices had been physically unlocked using Cellebrite digital forensics extraction tools.
Legal representatives for Jelena Kontić filed a formal criminal complaint on October 6 against unidentified individuals within the BIA and the national police force, as well as unnamed corporate representatives responsible at NSO Group. Because Pegasus is strictly licensed and distributed exclusively to sovereign states and government agencies, digital rights advocates emphasize that state-level authorization is an inherent requirement for its deployment. Despite multiple formal legal complaints filed over the past year regarding the unauthorized use of spyware against domestic critics, local authorities have yet to take effective legal or investigative action.
The advisory released by security researchers does not identify the specific software vulnerability or zero-day flaw exploited to compromise Rector Đokić’s phone, nor does it confirm whether contemporary mobile operating system updates mitigate the vector, leaving affected individuals without a simple patch-based remediation. Consequently, digital security experts continue to recommend specialized quarantine and monitoring measures for high-risk public figures, journalists, and activists operating in politically tense environments.
