Skip to content
Hacker Posts

Citizen Lab confirms Pegasus on Belgrade rector's iPhone

Citizen Lab and SHARE Foundation confirmed a zero-click Pegasus infection on University of Belgrade rector Vladan Đokić's iPhone, six days before Serbia's October 25 election.

Published 3 min read
spywarepegasusnso-groupserbia

The Citizen Lab (University of Toronto) and Serbia's SHARE Foundation said on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a backer of the country's student protest movement, was infected "with high confidence" with NSO Group's Pegasus spyware in 2026. The infection was zero-click — no link to tap, no file to open. The finding landed six days before Serbia's October 25 snap parliamentary election.

The primary source is the joint Citizen Lab / SHARE Foundation publication; it is carried in reporting by CyberScoop and The Hacker News.

What was confirmed

Citizen Lab analyzed forensic artifacts from Đokić's phone at his request, working with SHARE. It confirmed a Pegasus infection but does not name the operator, give a specific date within 2026, or say what was taken — only that Pegasus grants an operator the same access as the phone's owner, including messages, microphone and camera. Its investigation is ongoing. Đokić called the surveillance "another attempt of intimidation" and demanded an independent investigation.

A second person, Rade Bajić — a prosecutorial associate tied to an organized-crime corruption case — received Apple threat notifications; Citizen Lab treats that as high-confidence targeting but has not confirmed an infection on his device.

Attribution

Keep the hedge the researchers keep: Citizen Lab confirms the spyware (Pegasus, a product only sold to government clients) but does not attribute the operation to a named Serbian agency. The nearest prior link is Amnesty International's December 2024 finding that the domestic Android spyware NoviSpy sent data to an IP owned by Serbia's BIA security service. The BIA has called earlier spyware allegations "purely trivial sensationalism" and says it operates within the law.

The broader wave

  • SHARE's September 2 report described at least 14 people targeted in 2026, including a member of parliament and a local official, using Pegasus and a new NoviSpy variant.
  • With these cases, Citizen Lab counts at least 16 publicly known targets in Serbian civil society this year.
  • Lawyers for a previously confirmed Pegasus victim, Jelena Kontić, filed a criminal complaint on October 6 against unidentified BIA and police personnel and those responsible at NSO Group.

What to do

For journalists, activists, lawyers and officials in high-risk environments:

  1. Enable Lockdown Mode on iPhone and iPad — it has repeatedly blocked real-world mercenary-spyware exploit chains.
  2. Treat an Apple threat notification as a confirmed targeting signal: preserve the device, get a forensic consult (Citizen Lab, Amnesty Security Lab, Access Now's Digital Security Helpline), and do not factory-reset before imaging.
  3. Keep iOS fully current; zero-click chains are patched quietly and often.
  4. Segment sensitive work onto separate, minimally-connected devices where feasible.

Context

This is at least the second confirmed Pegasus infection in Serbia in 2026 and, per SHARE, the largest documented spyware-surveillance wave in the country to date. The timing — a confirmed infection of a prominent protest figure days before a snap election — is the story's sharpest edge, and the one the forensic record supports without needing to name who pulled the trigger.

Related stories