Citizen Lab Confirms Pegasus Spyware on Serbian University Rector's iPhone
Forensic analysis reveals NSO Group spyware targeted Vladan Đokić six days before Serbia's snap parliamentary election via a zero-click exploit.
Key points
- Citizen Lab confirmed Pegasus infection on rector Vladan Đokić's iPhone with high confidence.
- The attack used a zero-click exploit requiring no user interaction on the device.
- A second target, prosecutor Rade Bajić, received Apple Threat Notifications regarding mercenary spyware.
The Citizen Lab confirmed on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware in 2026. This finding emerged just six days before Serbia's scheduled October 25 snap parliamentary election, highlighting heightened surveillance activity during a critical political period.
The research group at the University of Toronto conducted the analysis at Đokić's request, working alongside the Serbian digital-rights organization SHARE Foundation. The lab determined with high confidence that the device was compromised using a zero-click exploit. This method allowed the spyware to install without Đokić tapping a link or opening any file, demonstrating a sophisticated attack vector that bypasses standard user interaction defenses.
Political Context and Investigation Status
The election was called in September following nearly two years of widespread protests. These demonstrations began in November 2024 after a railway station canopy collapsed in Novi Sad, killing sixteen people. Vladan Đokić is a prominent supporter of the student protest movement that has driven this sustained civic unrest against the government.
The Citizen Lab noted that its investigation into the attack remains ongoing. The organization did not identify the specific entity behind the intrusion in its initial report. Additionally, the lab did not provide a specific date within 2026 for when the infection occurred, only that it took place in that year before the October 19 announcement.
Additional Targets and Legal Cases
A second case involves Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime. Bajić worked on the "Generalštab" corruption investigation, which concerns a luxury development project linked to Jared Kushner, son-in-law of U.S. President Donald Trump. The case involves removing heritage protection from Belgrade's former army General Staff complex.
Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends these alerts when it detects activity consistent with mercenary spyware attacks, though it does not identify the attackers. The Citizen Lab treats such notifications as a high-confidence sign of targeting. Forensic analysis of Bajić's device is ongoing, and it is not yet confirmed whether his phone was successfully infected.
Bajić stated he was removed from the Generalštab investigation in November 2025 without explanation. In February, he discussed the case at a protest outside Serbia's Constitutional Court. In December 2025, prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and document falsification in the case, according to the Associated Press.
What should you do?
Security professionals should monitor for unusual device behavior or unexpected battery drain, which can indicate background spyware processes. Organizations should review Apple Threat Notification logs for any staff members who may be high-value targets due to their professional roles.
What to do and how to stay safe: Pegasus
- Monitor device diagnostics for anomalies such as rapid battery depletion or increased data usage that may indicate background spyware activity.
- Review Apple Threat Notification alerts immediately and treat them as high-confidence indicators of targeting, even if infection is not yet proven.
- Implement strict access controls for devices belonging to individuals involved in sensitive legal or political investigations.
- Maintain ongoing forensic readiness by preserving device artifacts and logs in case future analysis is required to confirm compromise.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who was confirmed to be infected with Pegasus spyware?
Vladan Đokić, the rector of the University of Belgrade, was confirmed to have an iPhone infected with Pegasus spyware by the Citizen Lab.
Did the victim have to interact with a link to get infected?
No, the infection used a zero-click exploit, meaning Đokić did not need to tap a link or open a file for the spyware to install.
Was Rade Bajić confirmed to be infected with spyware?
No, forensic analysis of Rade Bajić's device is ongoing. He received Apple Threat Notifications, which the Citizen Lab treats as a high-confidence sign of targeting, but infection has not been confirmed.
