Belgrade Rector Hacked With Pegasus, Citizen Lab Says

The rector of the University of Belgrade, Vladan Đokić, had his iPhone infected with NSO Group’s Pegasus spyware this year, according to researchers at the Citizen Lab. Đokić is a prominent backer of Serbia’s student protest movement. The finding lands less than a week before Serbians vote in snap parliamentary elections on 25 October.

The case adds to a growing list of Serbian civil-society figures caught up in mercenary spyware. It also shows how far the technology reaches: the infection used a zero-click exploit, so Đokić did not need to tap a link or open a file for his phone to be compromised.

In brief

Citizen Lab says it found “with high confidence” that Belgrade university rector Vladan Đokić’s iPhone was infected with NSO Group’s Pegasus in 2026, using a zero-click exploit.
A former organised-crime prosecutor, Rade Bajić, received an Apple threat notification; Citizen Lab says analysis of his device is ongoing and has not confirmed an infection.
Citizen Lab has not said who carried out the attack, and the findings come days before Serbia’s 25 October parliamentary election.

A zero-click infection on a protest figure’s phone

In a research note published on 19 October with the Serbian digital rights group SHARE Foundation, Citizen Lab said it analysed forensic artefacts from Đokić’s iPhone at his request. “We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026,” the researchers wrote. “The infection leveraged a zero-click exploit.” They added that their investigation into the case is ongoing.

Đokić has become a central figure in Serbia’s political crisis. Citizen Lab says he refused to help a government-led crackdown on student protesters, which brought intense pressure from the authorities. Serbian authorities raided his offices on 31 March 2026 and reportedly seized computers and servers. Until September he was often mentioned as a possible head of the Student List in the coming election.

Andrijana Ristić, a researcher at SHARE, told CyberScoop that this is the second confirmed Pegasus infection in Serbia this year. She declined to say when it was discovered, citing the sensitivity of the investigation. CyberScoop said Đokić was unavailable for comment.

A prosecutor’s warning, but no confirmed infection

The note also covers Rade Bajić, a former senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organised Crime. He worked on a corruption investigation into a failed “Trump Tower” project in Belgrade, known as the Generalštab case. He says he was removed from it in November 2025 without explanation and later spoke out at a demonstration about political interference.

Apple sent Bajić a threat notification on 13 August 2026 and a reminder on 27 August, according to Citizen Lab. The researchers treat such a notification as a high-confidence sign that his device was likely targeted with mercenary spyware. But their forensic analysis of his phone is still ongoing, and they have not confirmed an infection or identified any spyware on it.

Bajić believes his work is the reason. “In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” he told CyberScoop.

Citizen Lab says the two new cases bring to at least 16 the number of Serbian civil-society members publicly known to have been targeted or infected with mercenary spyware. Earlier this year, SHARE-led investigations with Citizen Lab and Amnesty International found at least 14 people targeted. CyberScoop reported that they included a member of parliament and a local government official.

What at-risk users can do

Citizen Lab’s advice applies well beyond Serbia. Anyone who receives an Apple threat notification should get expert help immediately: people in Serbia can contact the SHARE Foundation, and those elsewhere can use Access Now’s Digital Security Helpline. Citizen Lab also suggests close contacts such as family and colleagues get screened.

People who think they may be targeted because of their work should switch on Apple’s Lockdown Mode, which Citizen Lab says seriously increases a device’s security, and keep their devices updated.

Citizen Lab’s John Scott-Railton was blunt about the wider picture. “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression,” he told CyberScoop.

Our read

This is TSN’s analysis. A confirmed zero-click Pegasus infection on a university rector who has stood with protesters is a serious finding, especially with an election days away. What is still missing is the operator: Citizen Lab has not named one. The results of the forensic work on Bajić’s phone will show whether the second case moves from warning to confirmed infection.