Pegasus spyware targets Serbian pro-democracy figures amid protests
Two prominent Serbian pro-democracy supporters have recently been targeted by NSO Group’s Pegasus spyware.
According to a new report by The Citizen Lab at the University of Toronto, Vladan Đokić, Rector of the University of Belgrade, was one of the targets.
He’s a strong supporter of the Serbian students’ ongoing pro-democracy campaign and had previously launched an investigation into potentially corrupt officials, making him a thorn in the government’s side.
Until September, he was considered a potential head of the Student List for Serbia’s upcoming parliamentary elections on October 25th, 2026.
At Đokić’s request, The Citizen Lab analyzed his iPhone. Researchers found evidence that his phone was infected with NSO Group’s Pegasus spyware.
The infection leveraged a zero-click exploit, meaning that no interaction by the user, such as clicking a link or opening a file, was necessary for infection.
The second person who was targeted with Pegasus spyware was Rade Bajić, a former Senior Prosecutorial Associate at Serbia’s Public Prosecutor’s Office for Organized Crime (TOK) in Belgrade.
Bajić is best known for his investigation into the failed Trump Tower project in Belgrade, which he opened in 2024. An anonymous complaint alleging public corruption followed and got him thrown off the case in November 2025.
In February 2026, Bajić spoke at a protest, criticizing political interference in the case and other abuses of power.
On August 13th, Bajić received an Apple Threat Notification, saying that Apple had detected a targeted mercenary spyware attack against his iPhone. Two weeks later, he got a reminder of the attack.
According to The Citizen Lab, this indicates that Bajić’s iPhone was most likely targeted with spyware.
The Citizen Lab advises everyone who receives an Apple Threat Notification to take immediate action and contact trusted experts.
People who are at higher risk, such as human rights activists, journalists, academics, and politicians in authoritarian regimes, are advised to enable advanced security features, including Lockdown Mode for iOS and Advanced Protection for Android devices.
The latest findings of The Citizen Lab expand on earlier investigations that identified at least 14 people targeted with advanced spyware in Serbia in 2026, including activists, a member of the Serbian national parliament, a local councilor, and politicians belonging to the opposition.
That specific attack used an iMessage zero-click exploit to infect the devices with spyware.