Citizen Lab Reports Israeli Pegasus Spyware Infected University of Belgrade Rector’s iPhone Before Serbian Election

Serbia is preparing for snap parliamentary elections on October 25, amid nearly two years of protests against the 14-year rule of Aleksandar Vučić. In December 2025, prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and falsifying documents in the “Generalštab” case, according to one report. The same report does not link that case to the spyware findings described below.

In March, police raided the offices of Vladan Đokić, rector of the University of Belgrade, citing an investigation into a student’s death, according to one report. Đokić is a vocal supporter of the student protests against Vučić.

In August, Apple sent notifications to Rade Bajić, a senior prosecutorial associate. One report says Apple warned him of a high-confidence mercenary spyware attack. The other says he received Apple Threat Notifications on August 13 and August 27. A separate investigation is examining whether Bajić was also hacked, according to the first report. The second report says Citizen Lab considers the notifications a high-confidence indicator of targeting but not a confirmed infection.

On October 19, Citizen Lab reported that Đokić’s iPhone was infected with NSO Group’s Pegasus spyware in 2026, with high confidence. Citizen Lab worked with the Serbian digital-rights group SHARE Foundation and analyzed the phone at Đokić’s request. According to the second report, the discovery came six days before the election. The infection used a zero-click exploit, meaning Đokić did not need to click a link or open a file. Citizen Lab did not specify the exact date within 2026 or identify those responsible.

Đokić called the hacking a “serious attack on my privacy, security and the integrity of the post of rector.” The SHARE Foundation said at least 14 people had been targeted since early 2026, including students, activists, a member of parliament, and a local opposition councillor. The first report describes Pegasus as Israeli spyware in its headline, while the body attributes the software to NSO Group. Neither report says the Israeli government was involved in the targeting. Protecting people who speak publicly against those in power is a matter of justice for the vulnerable (Proverbs 31:8-9).

The investigation into the Đokić infection is ongoing, and the report does not detail what data, if any, was extracted from the phone.