-
Researchers confirmed that Pegasus spyware infected the iPhone of Vladan Đokić, the University of Belgrade rector, using a zero-click attack that required no action from him.
-
A second target, prosecutor Rade Bajić, received Apple warnings about spyware in August, though researchers have not confirmed infection on his device.
-
The cases add to a wider pattern of surveillance in Serbia, where at least 14 activists, students, and opposition figures have been targeted since early this year.
The University of Belgrade’s rector has been hit with powerful spyware. Researchers confirmed that Pegasus infected his iPhone this year. The attack required no action from him. It happened silently.
The rector, Vladan Đokić, supports student protests in Serbia. He has faced pressure from the government. A second target also received warnings. That person is a prosecutor who worked on a high-profile corruption case.
Understanding the attack
The Citizen Lab worked with the SHARE Foundation on this case. They confirmed the infection with high confidence. The malware was designed by an Israeli company called NSO Group. It executed a zero-click hack, meaning that the user did not click on any link or open an attachment.
The attack most likely happened in 2026. According to Citizen Lab, the investigation is ongoing. With the help of Pegasus, hackers can read messages and see photos. They can remotely turn on the microphone and camera of users. Pegasus also can find the location of users and copy contacts from the mobile phone.
Citizen Lab has been monitoring and analyzing the products of NSO Group for years. The lab has registered multiple cases of infections and has observed the use of the malware against journalists and activists. Their research is valuable because it uses forensic methods to prove infections, not mere allegations.
NSO Group says it sells the malware, Pegasus, only to governmental structures. Also, they claim that they hire a professional verification team to prevent misuse of the product, but people doubt this claim. As a result, courts and regulators in some regions took some measures against the company.
Who was targeted and why
Vladan Đokić leads the University of Belgrade. He refused to help the government stop student protests. This made him a target. Pro-government media criticized him often. Police also raided his office in March.
The protests began after a deadly incident in Novi Sad. A railway station roof collapsed and killed 16 people. Students blamed poor construction and official neglect. The protests grew into the largest challenge to the government in years.
A second person received Apple warnings. His name is Rade Bajić. He is a senior prosecutor in the organized crime unit. He worked on a case about a Trump Tower project in Belgrade. The case looked at whether officials broke the law to help the project. Bajić received Apple threat notifications in August. Researchers are still checking if his phone was actually infected.
Apple sends these alerts when it detects signs of state-sponsored spyware. The alerts do not name the attacker. They also do not confirm infection. But they are rare and serious. Apple has sent similar warnings to users in over 150 countries.
A wider pattern of surveillance
This is not the first incident in Serbia. Since the beginning of 2026, at least 14 people have received spyware warning alerts. They include students, activists, and politicians from opposition parties. The remarkable fact about this case is its timing. Local elections took place in March, while snap parliamentary elections are in October.
Serbia has a history of using spyware against critics. Citizen Lab previously found Pegasus on the phone of a student protester. Amnesty International also found local spyware called NoviSpy on the devices of activists. NoviSpy has a link to Serbian security services. It can access messages, photos, and microphone recordings.
Beyond spyware, cybercriminals also use other methods to compromise users, including fake GitHub repositories that spread BoryptGrab malware, highlighting the range of threats facing digital security.
The pattern points out that the operation seems to involve coordinated actions. The targets are mostly people associated with protests, corruption cases, and political opposition. Moreover, the spyware seems to occur during crucial political events. This leads to questions regarding the identity of the people behind this surveillance measure and their motives.
Serbia is not the only country dealing with the threat. The abuse of spyware has gained attention throughout Europe. The experiences of Poland, Hungary, and Greece show that similar scandals had occurred. The European Parliament has insisted on the necessity of having tighter regulations on the use of spyware. Still, the enforcement of the new rules appears to be lax.
What the targets and researchers say
Đokić called the spyware an attempt to intimidate him. He said it aims to stop critical voices. He demanded an independent investigation. He wants the public to know who installed and used the spyware.
Bajić did not make any public comments on the warnings. His office refused to give any clarifications about the situation. The prosecution is yet to verify if any investigation is ongoing regarding the malware infection.
Meanwhile, the SHARE Foundation cautioned against the dangers of digital repression. They stated that a lack of accountability will fuel the existence and spread of surveillance. They called for urgent and thorough investigations of the cases. The organization also invited Serbia to implement more reliable privacy and free expression guarantees.
Citizen Lab stressed the necessity of prompt forensic consultation for targets of a cybercrime operation. It is possible to recover the system, but it is also important to secure evidence. The lab also urged Apple to keep sending threat alerts. These warnings have helped expose cases that would otherwise stay hidden.
Serbian authorities have denied involvement in spyware attacks in the past. They did not comment on these new findings. The government has also rejected calls for an independent inquiry.
