Pegasus Spyware Infection Confirmed on Serbian University Rector’s iPhone Days Before Election

Vladan Đokić, the rector of the University of Belgrade and a notable supporter of Serbia’s student protest movement, had his iPhone infected with NSO Group’s Pegasus spyware in 2026, according to a report from Citizen Lab on October 19.

This revelation emerged six days prior to Serbia’s snap parliamentary election scheduled for October 25. The infection was facilitated by a zero-click exploit, meaning Đokić did not need to interact with any links or files for the spyware to be activated.

Citizen Lab reported high confidence in the infection’s detection but did not specify the exact date in 2026 when it occurred, nor did it identify the perpetrator behind the attack. The investigation remains ongoing.

The election was announced in September following nearly two years of protests triggered by a tragic incident in November 2024, when a railway station canopy collapsed in Novi Sad, resulting in 16 fatalities.

Citizen Lab, a research group based at the University of Toronto, conducted a forensic analysis of Đokić’s phone at his request, collaborating with the Serbian digital-rights organization SHARE Foundation. SHARE previously investigated a wave of spyware cases in Serbia that were made public in September.

Another case involves Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime, who was involved in the “Generalštab” corruption investigation into a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27.

Source: The Hacker News