CITIZEN Lab has confirmed that NSO Group’s Pegasus spyware was on the iPhone of Vladan Đokić, the Rector of the University of Belgrade, infected in 2026. The infection was achieved via a zero-click exploit, meaning no action by the user was required. The discovery was made in collaboration with the SHARE Foundation, and the analysts state they found the infection “with high confidence,” describing the investigation as ongoing.
The timing matters: the Rector is a prominent pro-democracy figure within Serbia’s student movement, and the infection was detected six days before Serbia’s snap parliamentary elections on 25 October 2026. Đokić had been publicly considered a potential candidate for the Student List, and authorities’ handling of protests has been a point of contention.
The analysis explains Pegasus can grant the operator the device’s full access, including private and encrypted messages, and the ability to activate the microphone and camera covertly. The Citizen Lab report notes that forensic artifacts were collected with Đokić’s consent and that Pegasus infection was confirmed in 2026.
In a related note, Rade Bajić, a prosecutor involved in a corruption investigation, received an Apple Threat Notification, which the researchers caution may indicate targeted activity; no infection has been publicly confirmed for him yet.
Overall, the study adds to the known count of Serbian civil society targets affected by Pegasus in 2026, bringing the total to at least 16. The report also references prior waves of attacks around local elections, with official Serbian authorities dismissing such findings as sensationalism. If you receive an Apple Threat Notification, treat the device as compromised and seek expert verification. Enable Lockdown Mode and keep iOS updated.