Pegasus Zero-Click Infects Serbian Academic Days Before Snap Vote
Citizen Lab confirms NSO Group spyware infected a high-profile academic days before Serbia’s snap parliamentary election.
Key points
- Vladan Đokić’s iPhone was infected with Pegasus spyware via a zero-click exploit in 2026.
- The discovery was made six days before Serbia’s October 25 snap parliamentary election.
- Prosecutor Rade Bajić received Apple Threat Notifications, suggesting further targeting.
The Citizen Lab confirmed that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware. This finding was published on 19 October 2026, six days before Serbia’s snap parliamentary election.
What happened
According to the Citizen Lab, forensic analysis of Đokić’s device revealed a high-confidence Pegasus infection in 2026. The attack utilised a zero-click exploit, meaning the victim did not need to interact with any content for the malware to install. The research group worked with the SHARE Foundation to examine artifacts collected at Đokić’s request.
The lab stated its investigation remains ongoing and did not identify the attacker. No specific date within 2026 was provided for the initial compromise. Đokić is a prominent supporter of Serbia’s student protest movement and had been named as a potential candidate for the Student List. Serbian authorities raided his offices on 31 March, seizing computers and servers.
Why it matters
This incident highlights the persistent threat of mercenary spyware against civil society figures in politically sensitive environments. The timing, occurring just days before a major election, underscores potential state-level intimidation tactics. A second case involves Rade Bajić, a senior prosecutorial associate who investigated corruption linked to a property project. Bajić received Apple Threat Notifications in August 2026, which the Citizen Lab treats as a high-confidence sign of targeting. His forensic analysis is also ongoing.
Next steps
- Monitor for new forensic reports from the Citizen Lab regarding the ongoing investigation.
- Track official statements from the University of Belgrade and Serbian authorities.
- Observe whether additional targets from the student movement or judiciary are identified.
Detection notes
Security teams should monitor for anomalous device behaviour consistent with spyware, such as unexpected battery drain or background process activity. Check for Apple Threat Notifications, which indicate detected attack patterns. Review network logs for connections to known command-and-control infrastructure. Isolate affected devices immediately upon suspicion to prevent data exfiltration. Preserve forensic artifacts before wiping devices to support incident response and attribution efforts.
What to do and how to stay safe: Pegasus
- Review mobile device management logs for unusual installation or configuration changes.
- Enable automated threat detection features provided by device manufacturers.
- Train staff to recognise signs of compromise, such as unexpected microphone or camera activation.
- Once the vendor provides an update, apply patches promptly to mitigate zero-click vulnerabilities.
Step-by-step guide: Infostealers Explained: How Data Theft Happens and How to Stop It
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who was targeted by the Pegasus spyware in this incident?
Vladan Đokić, rector of the University of Belgrade, and prosecutor Rade Bajić were identified as targets.
What type of exploit was used to infect the device?
A zero-click exploit was used, requiring no interaction from the user.
Has the attacker been identified?
No, the Citizen Lab did not identify who was behind the attack.
