Pegasus Found on Belgrade University Rector's iPhone Days Before Election

The University of Toronto's Citizen Lab said on October 19 that the iPhone of Vladan Đokić — rector of the University of Belgrade and a prominent backer of the student protest movement — was infected in 2026 with NSO Group's Pegasus spyware. The disclosure came six days before Serbia's snap parliamentary election, set for October 25.

The infection relied on a zero-click exploit: Đokić did not have to tap a link or open a file for it to work. The lab reports the infection with high confidence but gives no exact date within the year, names no perpetrator, and says its investigation is ongoing. The analysis was done at Đokić's request, together with the Serbian digital-rights group SHARE Foundation.

The election was called in September after nearly two years of protests that began in November 2024, when a railway station canopy collapsed in Novi Sad, killing 16 people.

A second case

The second episode involves Rade Bajić, a senior associate at Serbia's prosecutor's office for organized crime who worked on the "Generalštab" case — the lifting of heritage protection from the bombed-out former army General Staff complex in Belgrade to make way for a luxury development backed by a company linked to Jared Kushner, Donald Trump's son-in-law. Bajić received an Apple threat notification on August 13 and a reminder on August 27; Citizen Lab treats this as a high-confidence sign his phone was targeted, though the device analysis is not finished.

In the Generalštab case, prosecutors in December 2025 charged Culture Minister Nikola Selaković and three other officials. Bajić says he was taken off the investigation in November 2025 without explanation.

Denials and the running total

The report does not say what, if anything, was taken from the rector's phone. Pegasus gives its operator the same access as the owner, including encrypted messages, and can switch on the microphone and camera unnoticed. Đokić called the infection "another attempt of intimidation" and demanded an immediate independent investigation.

Serbia's civilian Security Information Agency (BIA) had already dismissed September's spying allegations as "purely trivial sensationalism" on September 3. With the two new cases, the number of known mercenary-spyware victims in Serbian civil society this year reaches at least 16.

Lockdown Mode and prompt iOS updates are what Citizen Lab recommends to people at risk; there is no case-specific patch for this attack.

Source: The Hacker News