Pegasus reached Belgrade rector’s iPhone, Citizen Lab finds

Pegasus spyware infected the iPhone of University of Belgrade rector Vladan Đokić in 2026, Citizen Lab said on October 19, exposing a prominent supporter of Serbia’s student movement to surveillance that required no click or opened attachment.

Researchers at the University of Toronto laboratory worked with Serbia’s SHARE Foundation to examine forensic artifacts supplied with Đokić’s consent. They described their finding as high confidence. The precise infection date remains unestablished, and their investigation continues.

The disclosure brings the publicly known number of Serbian civil-society members targeted or infected with mercenary spyware to at least 16, according to Citizen Lab. Its earlier research covered 14 people, including students, activists and opposition members. Serbian authorities raided Đokić’s offices on March 31, the laboratory said.

A second case concerns Rade Bajić, a former prosecutorial associate who worked on the Generalštab corruption investigation in Belgrade. He received an Apple threat notification on August 13 and a reminder on August 27. Citizen Lab described the alerts as strong indicators of targeting; its examination of his device remains unfinished.

Bajić confirmed the August warning to Reuters and said he did not know whether his phone had been hacked. Apple confirmed issuing threat notices without addressing the individual cases. Reuters said Serbia’s Interior Ministry and NSO Group had not answered its questions; Serbian officials have previously dismissed cyberespionage allegations.

Đokić described the intrusion as intimidation and an attack on the rector’s office, the Associated Press reported. The research identifies the spyware and a victim while leaving the customer behind the operation unidentified.