Citizen Lab Confirms Zero-Click Pegasus Hack of Belgrade University Rector's iPhone Days Before Serbia's Election

Researchers have confirmed that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was hacked with NSO Group's Pegasus spyware this year. The finding comes from a Citizen Lab research note published October 19, 2026, in collaboration with the Serbian digital rights group SHARE Foundation. It landed six days before Serbia's October 25 snap parliamentary elections.

The same note says Rade Bajić, a prosecutor who worked on a high-profile corruption investigation in Belgrade, received an Apple Threat Notification in August. In his case, the researchers have not yet confirmed an infection.

What Citizen Lab confirmed

Citizen Lab, working with SHARE, analyzed forensic artifacts collected from Đokić's iPhone at his request and with his consent. The report, written by John Scott-Railton, Bill Marczak, and Ron Deibert, states: "We found with high confidence that it was infected with NSO Group's Pegasus spyware in 2026. The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection."

The note does not give an exact infection date, name the exploit, or tie it to a specific iOS vulnerability, and it says the investigation is ongoing. SHARE researcher Andrijana Ristić told CyberScoop that SHARE did the initial forensic analysis, that this is the second confirmed Pegasus infection in Serbia this year, and that she would not say when the infection was discovered, citing the sensitivity of the investigation.

Citizen Lab describes Đokić as "famous for refusing to facilitate a government-led crackdown on student protesters." It notes that Serbian authorities raided his offices on March 31, 2026, and reportedly seized computers and servers, and that until September he was frequently mentioned as a possible head of the Student List for the October 25 vote.

A likely target, not yet a confirmed infection

Rade Bajić was a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime in Belgrade. According to Citizen Lab, he worked on the so-called "Generalštab" corruption investigation into a failed "Trump Tower" project planned for the site of a former protected heritage building, says he was removed from the case in November 2025 without explanation, and spoke out at a demonstration in February 2026.

Apple sent Bajić a Threat Notification on August 13, 2026, followed by a reminder on August 27. Citizen Lab calls that "a high confidence indicator that his device was likely targeted with mercenary spyware, such as Pegasus," but stresses that its forensic analysis of his device is still ongoing. Ristić told CyberScoop that neither SHARE nor Citizen Lab could yet say what type of spyware may have been used. Bajić told the outlet he believes his work on the case "was the sole reason for this unlawful spyware attack."

The note does not say who was behind either operation. Citizen Lab places the cases in the context of what it calls "broader state repression" of Serbia's protest movement but stops short of formally attributing these two cases to a specific government customer.

Part of a larger pattern

According to Citizen Lab, investigations led by SHARE, with support from Citizen Lab and Amnesty International's Security Lab, found that at least 14 people in Serbia were targeted with advanced spyware in 2026 alone, including protest movement members, activists, and opposition party members. Earlier findings included Pegasus on a student protester's phone, and Amnesty's Security Lab documented repeated use of homegrown Serbian government spyware against protesters. With the two new cases, Citizen Lab counts at least 16 members of Serbian civil society publicly known to have been targeted or infected. That combined figure covers both outcomes; it does not mean 16 confirmed infections.

The Hacker News and CyberScoop also covered the findings.

Are you affected?

Pegasus is used against a small number of people, typically journalists, activists, lawyers, politicians, and others singled out because of who they are or what they do. Most iPhone users are not targets. If you might be, these steps come from Citizen Lab's guidance and the tools it points to.

1. Keep your iPhone updated. Citizen Lab's note ends with this advice, and Apple's instructions show how to install updates and turn on automatic updates.
2. If you believe you may be targeted because of your work or identity, turn on Lockdown Mode. Citizen Lab says it "seriously increases the security of your device." It is found under Settings, Privacy and Security, Lockdown Mode.
3. Take any Apple threat notification seriously. According to Apple, an alert appears on the iPhone Lock Screen and in Settings, an email goes to the addresses tied to your Apple Account, and a banner appears at the top of your account page when you sign in at account.apple.com, which is also how to check that a notification is genuine. Citizen Lab says such a notification "indicates that you were likely targeted by a government using mercenary spyware."
4. If you receive one, get expert help right away. People in Serbia should contact the SHARE Foundation. Everyone else can reach Access Now's Digital Security Helpline, which supports journalists, activists, human rights defenders, and other members of civil society. Citizen Lab also recommends that family members and close collaborators get screened.
5. For a forensic check, the Mobile Verification Toolkit (MVT), an open-source tool from Amnesty International's Security Lab, can scan iPhone backups for known spyware indicators. Results need careful interpretation, so a clean scan is not proof of a clean phone, and a match is best reviewed with an expert.
6. For general safety advice, Citizen Lab points to the Security Planner, while noting that there is no substitute for personalized advice from a trusted digital security expert.

Citizen Lab says its investigations into both cases continue, so more detail on how Đokić's phone was compromised, and on what happened to Bajić's device, may still come.