University of Belgrade Rector and Anti-Corruption Prosecutor Targeted with NSO Group’s Pegasus Spyware Amid Serbia’s Political Turmoil

The iPhone of Vladan Đokić, the rector of the University of Belgrade and a prominent public supporter of Serbia’s growing student protest movement, was infected with advanced mercenary spyware developed by Israel’s NSO Group in 2026. According to a technical disclosure published by the University of Toronto’s Citizen Lab on October 19, the high-profile digital intrusion occurred just days before Serbia’s critical snap parliamentary election on October 25. The attack utilized a sophisticated zero-click exploit, meaning that Đokić was not required to click on a malicious link, download an attachment, or take any interactive action for the malware to successfully compromise his device.

The disclosure by Citizen Lab adds significant gravity to an ongoing political and civil rights crisis in Serbia, unfolding against a backdrop of prolonged public discontent, government friction, and intense electoral competition. Although researchers at Citizen Lab reported the infection with high confidence based on forensic artifacts retrieved from the device, their initial advisory did not specify the exact date of the infection within 2026, nor did it attribute the cyberattack to a specific state or institutional perpetrator. The investigation remains active as cybersecurity experts continue to analyze the telemetry and digital fingerprints left behind by the intrusion.

The political climate surrounding the disclosure is deeply polarized. The October 25 snap parliamentary election was officially called in September following nearly two years of sustained street protests, civil disobedience, and institutional gridlock. This massive wave of public demonstrations was initially sparked by a tragic infrastructural failure in November 2024, when a concrete railway station canopy collapsed in the northern city of Novi Sad, resulting in the deaths of 16 people. The tragedy galvanized public anger, giving rise to a nationwide student-led anti-corruption and pro-democracy movement that has continually challenged the established political leadership.

To uncover the scope of the digital surveillance, Citizen Lab analyzed forensic artifacts from the rector’s phone at Đokić’s direct request. The Canadian research group collaborated closely with the SHARE Foundation, a prominent Serbian digital-rights organization that previously spearheaded the investigation into an earlier wave of digital surveillance cases in Serbia, which were made public earlier in September.

Alongside the confirmation of the rector’s infected device, Citizen Lab’s ongoing investigations revealed a second high-profile case involving Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić played a crucial investigative role in the high-stakes "Generalštab" corruption inquiry. This politically sensitive case revolves around a controversial property development project involving the removal of heritage protection status from Belgrade’s bombed-out former army General Staff complex to clear the way for a luxury real estate development backed by a company connected to Jared Kushner, the son-in-law of U.S. President Donald Trump.

Official records indicate that Bajić received an official Apple Threat Notification on August 13, followed by a subsequent reminder alert on August 27. Apple routinely issues these specialized warnings when its internal security systems detect activity consistent with targeted attacks by commercial mercenary spyware—potent hacking tools developed by private firms and sold predominantly to national governments and intelligence services for intelligence-gathering and law enforcement. While Apple’s automated alerts do not explicitly identify the entities behind individual operations, Citizen Lab treats these notifications as a high-confidence indicator that a user’s smartphone was actively targeted by sophisticated threat actors. Forensic analysis of Bajić’s device is currently ongoing, and researchers have not yet officially confirmed whether the phone suffered a complete payload infection.

The legal and political ramifications of the Generalštab case have further strained public institutions in Belgrade. In December 2025, state prosecutors formally charged Culture Minister Nikola Selaković alongside three other senior government officials with abuse of official office and the falsification of documents in connection with the heritage site clearance, as reported by the Associated Press. Bajić has publicly stated that he was abruptly removed from the investigation in November 2025 without receiving any formal explanation from his superiors. By February, he took his grievances public, speaking openly about the inner workings of the case during a demonstration organized by student activists outside the steps of Serbia’s Constitutional Court.

While Citizen Lab’s preliminary technical note does not specify what data or communications may have been extracted from Rector Đokić’s compromised phone, the capabilities of NSO Group’s Pegasus software are well-documented within the global cybersecurity community. Once successfully deployed, Pegasus grants an operator deep, root-level access to a target device, effectively mirroring the privileges of the device’s owner. This includes full access to private and end-to-end encrypted messaging applications, emails, call logs, location data, and browser history, alongside the ability to remotely and covertly activate the smartphone’s internal microphone and camera to monitor the target in real time.

In an official English-language statement published by the University of Belgrade, Rector Đokić condemned the digital intrusion as "another attempt of intimidation" directed against academic independence and civil society. He demanded an immediate, independent, and transparent investigation, insisting that the findings be made fully public and that the individuals responsible for commissioning and deploying the spyware be identified and prosecuted under the law. Đokić also recalled that the pressure against the academic institution extended beyond digital domains, noting that local police forces had previously raided his university offices on March 31, seizing physical computers, hard drives, and administrative servers.

In response to earlier public allegations regarding state-sponsored surveillance of student activists and opposition politicians, the Security Information Agency (BIA), Serbia’s civilian intelligence and security service, issued a formal statement on September 3, which was subsequently translated and broadcast by independent regional media network N1. The BIA dismissed the allegations as "purely trivial sensationalism," maintaining that the agency operates strictly within the boundaries of the Serbian constitution and national law.

The newly uncovered cases involving the university rector and the organized crime prosecutor significantly expand a growing digital espionage scandal that first came to light on September 2, when the SHARE Foundation published findings showing that at least 14 individuals across Serbian civil society—including student activists, a local municipal councilor, and an opposition member of parliament—had been targeted with mercenary surveillance tools since the beginning of the year. Twelve of those targeted individuals received official Apple Threat Notifications during August, coinciding with a broader global security warning issued by Apple to users in more than 110 countries.

Among those earlier confirmed victims was Jelena Kontić, a student activist whose device infection with Pegasus was independently verified by Citizen Lab. Two other individuals included in the broader tally were found to have been targeted with a different surveillance tool known as NoviSpy, a specialized strain of Android spyware. Amnesty International previously reported in December 2024 that NoviSpy was engineered to exfiltrate sensitive personal data to remote command-and-control servers whose IP addresses were historically linked to the BIA. According to civil society reports, these installations often occurred while activists and independent journalists were undergoing police interrogations, after their devices had been physically unlocked using advanced forensic hardware tools manufactured by Cellebrite.

In response to these developments, legal representatives for Jelena Kontić filed a formal criminal complaint on October 6 targeting unidentified individuals within the BIA and local law enforcement agencies, as well as corporate decision-makers at NSO Group. Because Pegasus is commercially restricted and legally licensed exclusively to sovereign governments and accredited state intelligence agencies, civil rights advocates argue that domestic accountability is essential. However, lawyers and advocates note that prior criminal complaints filed over suspected spyware abuses in Serbia have yet to result in substantive investigative actions or legal accountability from state prosecutors.

Because the technical disclosures from Citizen Lab do not publicly name the specific zero-day vulnerability exploited against Đokić’s device or confirm whether current operating system releases natively mitigate the exact vector used, researchers emphasize that affected populations cannot rely on a single localized software patch. Instead, security researchers continue to urge high-risk individuals, journalists, civil rights defenders, and political dissidents to maintain heightened operational security practices as investigations into the broader deployment of mercenary spyware across Southeast Europe continue.