Israeli Spyware Linked to Serbian Election and Corruption Probe

The iPhone of Vladan Đokić, rector of the University of Belgrade and a key figure in Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, according to a report by the Citizen Lab on October 19. This discovery occurred six days before Serbia’s snap parliamentary election on October 25. The infection utilized a zero-click exploit, meaning Đokić did not need to interact with a link or file for the attack to succeed.

The Citizen Lab, a research group at the University of Toronto, identified the infection with high confidence. However, the report does not specify the exact date within 2026 or identify the perpetrators. It also notes that the investigation is ongoing. The election was called in September after nearly two years of protests that began following the collapse of a railway station canopy in Novi Sad in November 2024, which resulted in 16 deaths.

The Citizen Lab conducted its analysis of Đokić’s phone at his request, working with the Serbian digital-rights group SHARE Foundation. SHARE had previously led an investigation into an earlier wave of Serbian cases, which were made public in September. The group’s collaboration with the Citizen Lab highlights the growing concern over surveillance technologies in the region.

A second case involves Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić was involved in the “Generalštab” corruption investigation, which examined a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends these alerts when it detects activity consistent with attacks by mercenary spyware, such as Pegasus, but does not specify the source of the threat.

The Citizen Lab considers the notification a high-confidence indicator that Bajić’s phone was likely targeted. However, the report does not confirm whether the device was infected. The “Generalštab” case centered on the removal of heritage protection from Belgrade’s bombed-out former army General Staff complex to facilitate a luxury development linked to a company associated with Jared Kushner, U.S. President Donald Trump’s son-in-law.

In December 2025, prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and falsifying documents in the case. Bajić reported being removed from the investigation in November 2025 without explanation. In February 2026, he spoke about the case at a protest organized by student activists outside Serbia’s Constitutional Court.

The Citizen Lab’s report does not detail what, if any, data was extracted from Đokić’s phone. Pegasus spyware grants the operator access equivalent to the phone’s owner, including private and encrypted messages, and can activate the microphone and camera without the owner’s knowledge. The report underscores the potential for such surveillance to impact political processes and individual privacy.

Source: Read the original report