The University of Belgrade’s rector, Vladan Đokić, found his iPhone had been compromised by the notorious Pegasus spyware, as confirmed by the Citizen Lab on October 19, 2026. This discovery unfolded just a few days ahead of Serbia’s parliamentary elections slated for October 25. Đokić, who supports the nation’s student protest movement, became a target of a zero-click exploit, which requires no interaction from the victim to activate.
Spyware Infection Before Crucial Election
The revelation of spyware on Đokić’s device comes amidst a politically charged environment. The snap election was triggered by public dissent following a tragic incident in November 2024, where a railway station canopy collapse in Novi Sad resulted in 16 fatalities. Despite the high confidence in the findings, the Citizen Lab’s report did not specify the timeline within 2026 or disclose the perpetrators behind the attack, citing ongoing investigations.
Đokić had requested an analysis of his phone by the Citizen Lab, a research entity at the University of Toronto, in collaboration with Serbia’s SHARE Foundation. SHARE had previously exposed similar incidents in September, where several Serbian citizens were reportedly targeted with spyware.
Other High-Profile Targets
Another significant case involves Rade Bajić from Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić, involved in the corruption investigation linked to a Belgrade property project, received Apple’s threat warnings in August. While the forensic examination of his phone continues, it remains unclear whether his device was infected.
The corruption probe, known as the Generalštab case, centers on the removal of heritage protection from a former military site, facilitating a luxury development associated with Jared Kushner’s business interests. In December 2025, legal actions were taken against several officials, including the Culture Minister, for abuses related to this project.
Expanding Spyware Concerns
The use of Pegasus has raised alarms within Serbian civil society. SHARE Foundation’s reports indicate that at least 16 individuals, including activists and politicians, have been targeted with spyware this year. Amnesty International had previously linked the NoviSpy variant to Serbia’s security agency, BIA, suggesting misuse during activist interrogations.
Đokić condemned the spyware attack as an intimidation tactic and called for an independent, transparent investigation. Meanwhile, Serbia’s security agency dismissed earlier allegations of surveillance as baseless.
The Citizen Lab advises those at risk to activate Lockdown Mode on their iPhones and follow security protocols. They emphasize the importance of checking for infections if an Apple Threat Notification is received, urging affected individuals to seek immediate assistance from organizations like SHARE Foundation.
