Pegasus Spyware Found on Serbian University Rector's iPhone Before Election

Infection confirmed on rector's phone

Citizen Lab said on October 19 that the iPhone of University of Belgrade rector Vladan Đokić was infected with NSO Group's Pegasus spyware. The infection used a zero-click exploit and was found with high confidence. The lab's note provides no date within 2026, does not identify who was behind the attack, and says its investigation is ongoing.

The finding came six days before Serbia's October 25 snap parliamentary election. Đokić called the spyware on his phone "another attempt at intimidation" and demanded an independent investigation without delay, with its results made public and whoever installed and used the spyware prosecuted.

Second case involves prosecutor's associate

A second case concerns Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends such alerts when it detects activity consistent with an attack by mercenary spyware, and it does not say who is behind the attacks. Citizen Lab treats the notification as a high-confidence sign that the phone was likely targeted, though forensic analysis of the device is ongoing.

Bajić worked on the "Generalštab" corruption investigation into a property project backed by a company linked to Jared Kushner. According to Bajić, he was taken off the investigation in November 2025 without explanation, and in February he spoke about the case at a protest called by student activists.

Wider spyware campaign in Serbia

According to SHARE Foundation, at least 14 people in Serbia, including student activists, an opposition MP and a local councilor, had been targeted with spyware since the start of the year. Twelve received Apple Threat Notifications in August, when Apple warned users in 110 countries. Citizen Lab confirmed a Pegasus infection for student Jelena Kontić, and two other devices had a new version of the NoviSpy Android spyware installed. By the lab's count, the two new cases bring the number of people in Serbian civil society publicly known to have been targeted or infected this year to at least 16.

Amnesty International reported in December 2024 that NoviSpy was configured to send stolen data to a server whose IP address belonged to Serbia's Security Information Agency (BIA) and was installed on activists' and journalists' phones during police questioning, after the devices were unlocked with Cellebrite forensic tools. Lawyers for Kontić filed a criminal complaint on October 6 against unidentified individuals in the BIA and the police, as well as people responsible at NSO Group. Pegasus is sold only to governments and state agencies, and the complaints already filed over spyware in Serbia have brought no effective action.

Recommendations for at-risk users

Citizen Lab advises people at risk to turn on Lockdown Mode on their iPhone and keep iOS up to date. If you receive an Apple Threat Notification, assume the phone is infected until an expert has checked it, and get help at once from SHARE Foundation in Serbia or Access Now's Digital Security Helpline elsewhere. Close contacts such as family members and colleagues should also be screened for spyware.

Sources: The Hacker News