THE Citizen Lab confirmed that the iPhone of Vladan Đokić, the rector of the University of Belgrade and a notable figure in Serbia’s student protests, was infected with Pegasus spyware in 2026. The finding, announced on 19 October 2026, came six days before Serbia’s snap parliamentary election scheduled for 25 October. The infection used a zero-click exploit, meaning no user interaction was required.
The analysis was conducted by Citizen Lab in collaboration with Serbia’s SHARE Foundation, and the assessment notes high confidence but does not identify the attacker or provide a definite date of infection within 2026; the investigation remains ongoing. The case sits within a wider Serbian spyware wave reported by SHARE, which has involved multiple activists and officials who have received Apple Threat Notifications, indicating mercenary spyware activity.
The report also references a second high-profile case involving Rade Bajić, a senior prosecutorial official, who received an Apple Threat Notification in August 2026; the forensic status of Bajić’s device is described as ongoing and unconfirmed whether infected. Pegasus is described as giving operators the same access as the device owner, including private messages and the ability to activate the microphone or camera covertly.
The note does not name the exploit used against Đokić’s iPhone or state whether current iOS releases block it, and there is no case-specific fix available. Practical steps urged by the lab include enabling Lockdown Mode on iPhone, keeping iOS up to date, treating an Apple Threat Notification as a likely infection until an expert confirms otherwise, and having close contacts screened for spyware.