Citizen Lab confirms Pegasus spyware on Belgrade university rector’s phone
Researchers identified NSO Group’s Pegasus on the device of University of Belgrade Rector Vladan Đokić as Serbian elections approach next week.
Key points
- Citizen Lab confirmed Pegasus infection on University of Belgrade Rector Vladan Đokić’s phone this year.
- Second suspected victim is prosecutor Rade Bajić, who received an Apple threat notification in August.
- At least 15 Serbian individuals have been targeted with advanced spyware in 2026, according to SHARE Foundation.
The Citizen Lab confirmed on Monday that the mobile device belonging to University of Belgrade Rector Vladan Đokić was infected with Pegasus spyware at some point this year. This discovery adds to a growing series of surveillance incidents involving Serbian opposition figures ahead of national elections scheduled for October 25.
Đokić has publicly supported student protests demanding the permanent removal of former President Aleksandar Vučić from government power. Vučić, who recently left the presidency due to term limits, is currently running for prime minister. He previously held that office from 2014 to 2017 and is widely expected to regain control of the country if reelected in the upcoming vote.
Context of Surveillance Campaign
A second individual, prosecutor Rade Bajić, is currently under analysis by the Citizen Lab. According to a press release from Serbia’s SHARE Foundation, Bajić received an Apple threat notification in August. Bajić previously investigated allegations of corruption involving a Vučić-led effort to sell a protected historic building to Jared Kushner, son-in-law of U.S. President Donald Trump.
Apple threat notifications are generally regarded by security experts as high-confidence indicators of commercial spyware targeting. The SHARE Foundation, in collaboration with the Citizen Lab and Amnesty International, has identified at least 15 people targeted with advanced spyware in Serbia during 2026. These findings suggest a persistent campaign against civil society members.
Impact on Civil Society
Serbian authorities have reportedly used NSO Group’s Pegasus against regime opponents for an extended period. Student protests have disrupted Belgrade since November 2024, originating from anti-corruption demonstrations. In recent months, several other students and journalists have also been found to have been targeted with spyware, broadening the scope of the surveillance beyond political leaders.
Adrijana Ristić, a researcher at the SHARE Foundation, stated that there has been increasing physical and digital repression. She noted that the targeting is broad, involving not just spyware but also leaked confidential communications and direct attacks on journalists. These developments raise questions about NSO Group’s assurances that it does not do business with repressive governments that abuse its technology.
A spokesperson for NSO Group did not respond to requests for comment. Similarly, a spokesperson for the Serbian embassy in Washington did not provide a response. The lack of official comment leaves the extent of state-sponsored surveillance unclear, though the technical evidence from the Citizen Lab remains specific.
What should you do?
Security professionals monitoring this situation should track further disclosures from the Citizen Lab and SHARE Foundation. Organizations supporting at-risk individuals in Serbia should review their digital hygiene protocols. Analysts should note that Apple threat notifications serve as a strong indicator of potential compromise.
What to do and how to stay safe: Pegasus
- Monitor official channels from the Citizen Lab and SHARE Foundation for updates on confirmed victims and new technical indicators of compromise.
- Review mobile device logs for unexpected restarts or battery drain, which can sometimes indicate background spyware activity, though these signs are not definitive.
- Ensure that all devices running iOS or Android are updated to the latest security patches provided by the manufacturer to mitigate known vulnerabilities.
- Encourage at-risk individuals to use encrypted communication channels and to avoid clicking on suspicious links or downloading unverified attachments.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who confirmed the Pegasus infection on Vladan Đokić’s phone?
The Citizen Lab, a digital forensics research institute, confirmed the infection on Monday.
How many people have been targeted in Serbia in 2026?
At least 15 people have been targeted with advanced spyware, according to the SHARE Foundation press release.
What is the significance of the Apple threat notification?
Apple notifications are widely considered high-confidence indicators of commercial spyware targeting, according to the source material.
