Citizen Lab Confirms Pegasus Infection on Serbian University Rector’s iPhone Before Election
Summary
Citizen Lab confirmed with high confidence that University of Belgrade rector Vladan Đokić’s iPhone was infected with Pegasus via a zero-click exploit. The attacker is unknown, and the investigation is ongoing.
Key points
- Citizen Lab found high-confidence evidence that Đokić’s iPhone was infected with NSO Group’s Pegasus spyware in 2026.
- The infection used a zero-click exploit, requiring no link tap or file opening by Đokić.
- The lab did not identify the attacker or when in 2026 the infection occurred; its investigation is ongoing.
- A separate case involves prosecutor’s office associate Rade Bajić, whose Apple Threat Notifications suggest his phone was likely targeted; forensic analysis is ongoing and infection is unconfirmed.
- Citizen Lab says the two cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.
- The article reports no case-specific fix for Đokić’s phone because the exploited flaw and whether current iOS releases block it are unknown.
Article Details
- Victim Organization
- University of Belgrade
- Incident Type
- Confirmed Pegasus spyware infection of Vladan Đokić's iPhone using a zero-click exploit.
- Disclosure Date
- 2026-10-19
- Operational Impact
- The infection was confirmed with high confidence. The source does not report what, if anything, was taken from the phone.
- Claim Status
- confirmed
People
Rade BajićSenior prosecutorial associate who received Apple Threat Notifications; Citizen Lab considered his phone likely targeted, but its forensic investigation was ongoing and infection was not established.Vladan ĐokićRector of the University of Belgrade whose iPhone was confirmed by Citizen Lab to be infected with Pegasus.
Malware
NoviSpyOne was Jelena Kontić, a student whose Pegasus infection the Citizen Lab confirmed. The other two had a new version of NoviSpy, an Android spyware, installed on their phones.PegasusThe iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.
Vendors
Applecorruption investigation into a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27.Cellebriteon activists' and journalists' phones during police questioning, after the devices were unlocked with Cellebrite forensic tools.NSO GroupThe iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.
Products
iOSThe note does not name the flaw used against Đokić's phone or say whether current iOS releases block it, so there is no case-specific fix to install. The lab's advice for people at risk because of who they are or whatiPhoneThe iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.