Researchers Confirm Pegasus Infection on Serbian University Rector’s Device
Summary
Researchers confirmed Pegasus infected University of Belgrade rector Vladan Ðokić’s device in 2026 via a zero-click exploit. Lawyer Rade Bajić also received an Apple spyware threat notification, but the spyware type on his device remains unknown.
Key points
- Citizen Lab confirmed with high confidence that Pegasus infected rector Vladan Ðokić’s device in 2026.
- The infection used a zero-click exploit, requiring no click or file opening, according to the lab’s report.
- The SHARE Foundation described this as Serbia’s second confirmed Pegasus infection this year.
- Lawyer Rade Bajić received an Apple spyware threat notification; the investigation is ongoing, and researchers could not identify the spyware type.
- Bajić believes his work prosecuting a corruption case involving Serbian officials led to his targeting; that motive is his assessment.
- The cases follow a previously reported wave involving 14 people targeted with Pegasus and a newer version of NoviSpy, according to the SHARE Foundation.
Article Details
- Victim Organization
- University of Belgrade rector Vladan Ðokić and lawyer Rade Bajić
- Incident Type
- Targeted spyware surveillance; Pegasus infection of Ðokić’s device was confirmed, while the spyware affecting Bajić’s device remains unidentified.
- Claim Status
- confirmed
People
Andrijana RistićSHARE Foundation researcher who conducted the initial forensic analysis and discussed the investigations.John Scott-RailtonSenior researcher at The Citizen Lab who commented on Pegasus and spyware abuse.Rade BajićLawyer with Serbia’s Public Prosecutor’s Office for Organized Crime; received an Apple threat notification, but the spyware affecting his device has not been identified and the investigation is ongoing.Vladan ĐokićRector of the University of Belgrade; Citizen Lab reported with high confidence that his device was infected with Pegasus in 2026.
Malware
FinFisherRistić described surveillance in Serbia as longstanding, tracing it to earlier tools such as FinFisher and alleged dealings with the hacking group Hacking Team — along with the original NoviSpy report by AmnestyNoviSpyThat wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.PegasusThat wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.
Vendors
Tools
Countries
Industries
GovernmentThat wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.LegalAfter the incident, Đokić accused authorities of trying to humiliate the institution, saying police entered without prior notice or clear legal grounds.