Citizen Lab confirms Pegasus infection on Serbian university rector’s iPhone

Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026. The finding was published on October 19, six days before Serbia’s October 25 snap parliamentary election.

The infection used a zero-click exploit, meaning Đokić did not need to open a file or follow a link for the compromise to occur. Citizen Lab did not provide a date for the infection within 2026, identify the party responsible, or name the vulnerability used. Its investigation is continuing.

Forensic finding follows a wider Serbian spyware wave

Researchers at the University of Toronto’s Citizen Lab examined forensic artifacts from the phone at Đokić’s request and worked with the Serbian digital-rights organization SHARE Foundation. SHARE had already investigated an earlier group of Serbian cases disclosed in September.

Those cases emerged amid a prolonged protest movement that began after a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. Serbia called the snap election in September after nearly two years of protests.

Citizen Lab said the newly disclosed cases raise the number of people in Serbian civil society publicly known to have been targeted or infected by mercenary spyware in 2026 to at least 16. SHARE reported on September 2 that at least 14 people, including student activists, an opposition member of parliament and a local councillor, had been targeted since the start of the year.

Second case remains under forensic review

A second case involves Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple issues these notifications when it detects activity consistent with attacks involving mercenary spyware, but does not attribute an attack to a specific operator.

Citizen Lab treats the notification as a high-confidence indication that Bajić’s device was likely targeted. Its forensic review of his phone is still under way, and the researchers have not said whether it was infected.

Bajić worked on the Generalštab corruption inquiry involving a Kushner-linked property project in Belgrade. He has said he was removed from that investigation in November 2025 without explanation. The Citizen Lab note does not connect the reported targeting to a particular actor or motive.

What the Pegasus finding means for high-risk users

Pegasus can provide its operator with the same access as the device owner, including access to private and encrypted messages, and may activate a microphone or camera without the owner’s knowledge. Citizen Lab’s note does not state what data, if any, was taken from Đokić’s phone.

Đokić described the spyware infection as “another attempt of intimidation” and called for an independent investigation, publication of its results, and prosecution of those responsible. Serbia’s Security Information Agency, or BIA, rejected earlier allegations of surveillance of students and opposition politicians, saying it operates within Serbian law.

There is no case-specific patch recommendation because the researchers did not identify the flaw used or say whether current iOS releases block it. For organisations and individuals at elevated risk, the practical response is to enable Lockdown Mode, keep iOS current, treat an Apple Threat Notification as a possible infection, obtain specialist assistance quickly, and consider screening close contacts whose devices could also be targeted.