The rector of the University of Belgrade was infected with NSO Group’s Pegasus spyware in 2026, researchers said Monday, while a Serbian organized-crime prosecutor received an Apple warning indicating he was likely targeted by mercenary spyware. The findings from The Citizen Lab and Serbia’s SHARE Foundation add two prominent figures to a growing list of people targeted amid the country’s student-led protest movement and ahead of snap parliamentary elections scheduled for Oct. 25. [1]
Forensic analysis of an Apple iPhone belonging to Vladan Đokić, the university’s rector and a public supporter of the pro-democracy movement, found Pegasus infection with high confidence. The attack used a zero-click exploit, meaning Đokić did not need to open a file, click a link or take any other action for the compromise to occur. Citizen Lab said its investigation remains ongoing, and the available report does not identify the specific exploit, a CVE identifier or a confirmed operator.
Rade Bajić, a former senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime, received an Apple Threat Notification on Aug. 13 and a reminder on Aug. 27, according to the researchers. The alerts are high-confidence indicators that a device was likely targeted with mercenary spyware such as Pegasus, but forensic analysis of Bajić’s phone has not yet established which tool, if any, successfully infected it. Apple describes threat notifications as targeted warnings for users who may have been singled out because of their identity or work.
The two cases bring to at least 16 the number of Serbian civil-society members publicly known to have been targeted or infected with mercenary spyware, Citizen Lab said. Earlier 2026 investigations by SHARE, Citizen Lab and Amnesty International’s Security Lab involved protesters, activists and opposition figures, including cases involving Pegasus and Serbian-developed spyware. Researchers have not publicly attributed Đokić’s infection to Serbian authorities, although the cases have emerged alongside mounting pressure on critics and allegations that government spyware was used against protesters. [1]
Đokić has backed students protesting corruption after the 2024 Novi Sad railway-station canopy collapse and faced a March raid on university offices in which computers and servers were reportedly seized. Bajić worked on the “Generalštab” corruption investigation concerning a proposed redevelopment of a protected Belgrade site and has said his involvement made him a target. The findings do not establish who ordered either operation, and NSO Group’s Pegasus licensing policies do not by themselves prove that a particular government conducted an attack.
People who receive an Apple Threat Notification should preserve the alert, seek help from a trusted digital-security organization and avoid resetting or discarding a potentially compromised device before forensic review. At-risk iPhone users should install current software updates and consider Apple’s Lockdown Mode; Apple warns that the feature is intended for the small number of people facing highly sophisticated attacks. Because the researchers have not published a CVE, patch number or public proof of concept for the Pegasus exploit used here, defenders should focus on device-specific forensic assistance and Apple’s threat-notification guidance rather than assuming that a conventional vulnerability fix alone resolves the risk.
