The escalating digital surveillance crisis in the Balkans has reached new heights following revelations that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s notorious Pegasus spyware in 2026. According to a research note published on October 19 by the University of Toronto’s Citizen Lab, the sophisticated intrusion occurred just six days before Serbia’s highly anticipated snap parliamentary election on October 25.
The finding underscores a disturbing pattern of digital targeting directed at academic leaders, civil society figures, judicial officials, and political opposition members in the European candidate country. The forensic analysis conducted by the Citizen Lab—acting at the request of Đokić in collaboration with the Serbian digital-rights organization SHARE Foundation—revealed that the infection utilized a zero-click exploit. This advanced attack method means Đokić did not need to tap a malicious link, download an attachment, or take any interactive steps for the spyware to successfully breach his device.
While the Citizen Lab concluded with high confidence that the infection took place, its preliminary research note does not specify a precise date within 2026, nor does it definitively identify the state or non-state actor behind the cyberattack. Investigations into the breach remain ongoing. The backdrop of the incident is rooted in months of intense political turmoil across Serbia. The snap parliamentary election was called in September following nearly two years of continuous public demonstrations. These mass protests erupted after a tragic railway station canopy collapse in Novi Sad in November 2024, an infrastructure disaster that claimed the lives of 16 people and sparked nationwide outrage over systemic government negligence and institutional corruption.
The SHARE Foundation, which led the forensic investigation into Đokić’s phone, has been at the forefront of documenting digital repression in the country. The organization previously spearheaded an investigation into an earlier wave of Serbian spyware cases that made international headlines in September. Among those earlier victims was Jelena Kontić, a student activist whose Pegasus infection was also officially confirmed by the Citizen Lab.
The scope of targeted individuals expanded further with a second high-profile case involving Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić played a key role in handling the politically sensitive "Generalštab" corruption investigation. The high-stakes case revolves around the controversial removal of heritage protection from Belgrade’s bombed-out former army General Staff complex to clear the path for a lucrative luxury real estate development. The project is backed by a corporate entity connected to Jared Kushner, the son-in-law of U.S. President Donald Trump.
Bajić’s exposure came to light after he received official Apple Threat Notifications on August 13, followed by a security reminder on August 27. Apple issues these automated alerts to users when its security telemetry detects high-fidelity patterns consistent with targeted attacks by mercenary spyware. These commercial surveillance tools are exclusively developed, marketed, and sold by private firms—such as Israel-based NSO Group—to authorized government agencies and state intelligence services. While Apple explicitly refrains from attributing the origin of such attacks to specific state actors due to the sophisticated operational security employed by perpetrators, the Citizen Lab treats these official warnings as a high-confidence indicator that Bajić’s device was actively targeted. Forensic analysis of Bajić’s phone is currently ongoing, and researchers have not yet confirmed whether the device suffered a successful intrusion or data extraction.
The underlying Generalštab controversy has created deep friction within Serbian state institutions. In December 2025, anti-corruption prosecutors formally charged Culture Minister Nikola Selaković alongside three other senior government officials with abuse of office and the falsification of official documents in connection with the property deal, as reported by the Associated Press. Bajić has publicly stated that he was abruptly removed from the high-profile investigation in November 2025 without receiving any official explanation. In February, he spoke openly about the inner workings of the case during a demonstration organized by student activists outside Serbia’s Constitutional Court.
The deployment of Pegasus grants its operator complete, unrestricted access to a compromised device, effectively mirroring the privileges of the phone owner. According to the Citizen Lab’s extensive technical analyses of similar incidents, the spyware can quietly intercept private and heavily encrypted messaging applications, harvest personal files and contact lists, and remotely activate the device’s microphone and camera without the user’s knowledge or consent.
Responding to the security breach, Rector Đokić issued an English-language statement through the university, characterizing the deployment of spyware against his personal device as "another attempt of intimidation." He formally demanded an immediate, independent investigation into the cyberattack, insisting that the findings be made fully transparent to the public and that the individuals responsible for installing and operating the surveillance software be held legally accountable. Đokić also noted the intense pressure his institution has faced, recalling that police previously raided the rector’s offices on March 31, seizing critical computers and institutional servers.
Serbia’s civilian security service, the Security Information Agency (BIA), has vigorously denied any involvement in digital espionage. In an official statement released on September 3 and translated by regional broadcaster N1, the agency dismissed earlier allegations that students, academics, and opposition politicians were being targeted as "purely trivial sensationalism," maintaining that all of its operational activities are conducted strictly within the boundaries of Serbian law.
These latest revelations significantly expand a disturbing trend initially documented by the SHARE Foundation on September 2. At that time, the digital-rights group reported that at least 14 prominent individuals across Serbian civil society—including student leaders, an opposition member of parliament, and a local councilor—had been targeted with mercenary spyware since the beginning of the year. Twelve of those individuals received Apple Threat Notifications in August, coinciding with a broader global security advisory issued by Apple to users across 110 countries facing sophisticated cyber threats.
Among the victims identified in the earlier wave was Jelena Kontić, whose Pegasus infection was verified by the Citizen Lab, while two other individuals were found to have been targeted with NoviSpy, a specialized variant of Android spyware. Amnesty International previously reported in December 2024 that NoviSpy was explicitly configured to route stolen data back to external servers whose IP addresses traced directly to the BIA. According to civil society reports, this particular malware was often surreptitiously installed on the phones of journalists and activists during formal police questioning after their devices had been forcibly unlocked using specialized Cellebrite forensic extraction equipment.
The mounting technical evidence and legal challenges have thus far yielded little institutional accountability within Serbia. On October 6, legal representatives acting on behalf of Kontić filed a formal criminal complaint targeting unidentified individuals within the BIA and local law enforcement, alongside responsible executives at NSO Group. Because Pegasus is strictly licensed and sold exclusively to sovereign governments and state intelligence apparatuses, civil society advocates argue that domestic authorities bear ultimate responsibility for its deployment. However, previous criminal complaints filed regarding state-sponsored spyware abuse in Serbia have failed to prompt effective judicial action or independent inquiries.
The technical advisory issued alongside the latest cases did not disclose the specific zero-day vulnerability exploited to compromise Rector Đokić’s iPhone, nor did it confirm whether current versions of Apple’s iOS operating system inherently block the vector used, leaving affected public figures with limited immediate recourse. For civil society members operating in high-risk environments, international cybersecurity researchers continue to emphasize heightened vigilance.
The discovery of these latest infections brings the total number of publicly documented civil society targets in Serbia to at least 16 individuals for the year, cementing the country’s position at the center of a growing international debate regarding the unchecked proliferation and abuse of commercial mercenary spyware against democratic institutions and academic freedom.
