Citizen Lab finds Pegasus on Belgrade University rector's phone ahead of Serbia's 25 October election

TLDR

• Citizen Lab found with high confidence that Belgrade University rector Vladan Đokić's iPhone was infected with Pegasus in 2026.¹²
• The infection was zero-click; prosecutorial associate Rade Bajić got an Apple threat notification and his device is still being analysed.¹³
• Citizen Lab counts at least 16 Serbian civil-society members publicly known as targeted, with parliamentary elections due on 25 October.¹

The Citizen Lab, working with the SHARE Foundation, says it found with high confidence that Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware in 2026.¹ The infection used a zero-click exploit, and the forensic artefacts came from Đokić's iPhone, collected at his request and with his consent; Citizen Lab says its investigation is ongoing.¹ Đokić is a supporter of the student protest movement, authorities raided his offices on 31 March, and until September he was often mentioned as a possible head of the Student List for the 25 October snap parliamentary elections.¹ The Record dates the raids to late March.²

The second case concerns Rade Bajić, a senior prosecutorial associate at Serbia's Organised Crime prosecutor's office who worked on the Belgrade corruption case tied to the Generalštab building and the planned Trump Tower, and who was removed from it in November 2025.¹ Bajić received an Apple threat notification on 13 August and a reminder on 27 August, which Citizen Lab calls a high-confidence indicator of likely mercenary-spyware targeting, and its analysis of his device continues.¹ CyberScoop quotes SHARE's Ristić as saying that neither SHARE nor Citizen Lab could pinpoint which spyware was involved in his case.³ Bajić told The Record and CyberScoop that his involvement in the case was the "sole reason" he was being targeted.²³

CyberScoop quotes Ristić as saying this is the second confirmed Pegasus infection in Serbia this year, and says she declined to say when the Đokić infection was discovered.³ SHARE had earlier described a wave of 14 people targeted with Pegasus and a new version of the NoviSpy spyware in September.³ Citizen Lab says at least 14 civil-society members were targeted earlier in 2026, bringing the total publicly known to at least 16, while The Record, citing SHARE's press release, says at least 15 were targeted in 2026.¹²

The Citizen Lab text reviewed does not name who deployed Pegasus against Đokić.¹ The Record writes that Serbian authorities have used Pegasus against regime opponents for some time, and says NSO Group and the Serbian embassy did not respond to its requests for comment.² Citizen Lab's background notes that Amnesty International's Security Lab has found repeated use of homegrown Serbian government spyware against protesters.¹ The Record reports that Aleksandar Vučić left the presidency weeks ago and is running for prime minister in the 25 October election.²

Why it matters: the confirmed zero-click infection of a prominent university head, in the week before a national election, adds to a pattern of mercenary spyware being found on opposition-aligned and civil-society figures in Serbia.¹²³