Summary
- Citizen Lab and the SHARE Foundation found high-confidence evidence of a Pegasus infection on Vladan Đokić’s iPhone in 2026.
- Rade Bajić received Apple threat notifications in August, but forensic confirmation of infection remains outstanding.
- Researchers describe wider spyware targeting of Serbian civil society, without attributing the new infection to an identified operator.
Researchers at the University of Toronto’s Citizen Lab have confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware during 2026. The finding comes from a forensic examination conducted with the SHARE Foundation and published on 19 October, adding another confirmed infection to a growing body of evidence concerning surveillance directed at Serbian civil society.
The investigation also concerns Rade Bajić, a former senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organised Crime. He received an Apple threat notification on 13 August and a reminder on 27 August 2026, indicating likely targeting with mercenary spyware. Citizen Lab’s forensic examination of his device is continuing, and the researchers have not established an infection. His case therefore rests on Apple’s targeting warning rather than on recovered Pegasus artefacts.
Đokić gave permission for forensic material from his iPhone to be examined. Citizen Lab says the findings establish a Pegasus infection in 2026 through a zero-click exploit, which would not have required him to open a link or attachment. The organisation has not publicly identified the operator of the spyware in this case, nor established an exact infection date in the material released on 19 October.
The rector has been closely associated with the student-led campaign that followed anti-corruption protests beginning in November 2024. According to Citizen Lab, he resisted pressure on universities during the protests and subsequently faced public attacks. Serbian authorities searched his offices in March 2026 and reportedly seized computer equipment. Those circumstances establish the political context of the research, but they do not by themselves prove who was responsible for deploying Pegasus.
Bajić’s experience is connected to a different institution and investigation. He had worked on a case involving a proposed development on the former General Staff headquarters site in Belgrade, where questions about protected heritage status and alleged corruption had become politically contentious. He says he was removed from the case in November 2025. His subsequent Apple warnings show that surveillance concerns extend beyond student organisers to people involved in sensitive public accountability work.
Combining the newly examined cases with earlier research, Citizen Lab says at least 16 Serbian civil society figures are publicly known to have been targeted or infected with mercenary spyware. The number brings together different categories of evidence. Some cases are supported by forensic traces of infection; others involve credible targeting notifications. It must not be read as a total of 16 confirmed Pegasus infections.
The latest disclosure follows a September Citizen Lab report confirming a Pegasus infection on the phone of an unnamed member of the Serbian student movement. That earlier case involved evidence from late 2025 and early 2026 and an exploit path associated with Apple’s messaging service. Although the two investigations concern the same commercial spyware family and political environment, the researchers have not established that the new cases were carried out by the same operator or through the same particular exploit.
Pegasus can give its operator extensive access to a compromised smartphone, including material displayed and stored on the device. A successful endpoint compromise can expose messages and contact information even where communications were protected in transit by end-to-end encryption. Citizen Lab’s announcement does not identify which data, if any, was collected from Đokić’s device; the documented infection is not itself an inventory of information taken.
The documented infection sits alongside earlier investigations of spyware targeting Serbian activists and journalists. Forensic traces demonstrate a compromise of a particular phone, while political pressure, office searches and the recipient’s public role help establish context without identifying the person or institution directing an operation. Citizen Lab has not attributed the new infection to Serbian state authorities or linked Bajić’s notifications to a confirmed operator.
Citizen Lab and the SHARE Foundation say their examinations are continuing. The analysis of Bajić’s device has yet to determine whether the targeting warning corresponded to an actual infection.
