Citizen Lab Finds Pegasus Spyware on Belgrade University Rector's iPhone Days Before Serbia's Vote

The iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware in 2026. That is the finding of the Citizen Lab, the University of Toronto research group, which announced it Monday, Oct. 19, working with Serbia's SHARE Foundation.

The lab rated its confidence in the finding as high. The infection used a zero-click exploit, so Đokić did not have to tap a link or open a file. Serbia's snap parliamentary election is Oct. 25.

What the lab found

Citizen Lab analyzed forensic artifacts taken from Đokić's phone at his request and with his consent. Its note gives no date for the infection beyond "2026." It does not say who operated the spyware or what, if anything, was taken. The investigation is ongoing.

Pegasus gives whoever runs it the same access as the phone's owner. That includes private and encrypted messages, and the ability to switch on the microphone and camera without the owner knowing, according to the lab's analysis of an earlier Serbian case.

Andrijana Ristić, a researcher at SHARE, said this is the second confirmed Pegasus infection in Serbia this year. She declined to say when the infection was discovered, citing the sensitivity of the investigation.

Đokić called it "another attempt of intimidation" in a statement published by the university. He demanded an independent investigation without delay, with its results made public and whoever installed and used the spyware prosecuted.

A rector already in the government's sights

Đokić has led the University of Belgrade since 2021. He became a national figure by refusing to facilitate a government-led crackdown on students protesting the November 2024 collapse of a railway station canopy in Novi Sad, which killed 16 people.

On March 31, 2026, Serbian authorities raided his offices and reportedly seized computers and servers. Đokić said police entered without prior notice or clear legal grounds, and accused authorities of trying to humiliate the institution. Citizen Lab notes that he has been extensively targeted by attacks in pro-government media.

Until September he was frequently mentioned as a potential head of the Student List for the Oct. 25 snap parliamentary elections, according to the lab.

The prosecutor and the Kushner-linked project

The second case is Rade Bajić, a senior prosecutorial associate at the Public Prosecutor's Office for Organized Crime. He worked on the "Generalštab" investigation into the removal of heritage protection from Belgrade's bombed-out former army General Staff complex. The site was slated for a luxury development backed by a company linked to Jared Kushner, President Donald Trump's son-in-law.

Bajić received an Apple Threat Notification on Aug. 13 and a reminder on Aug. 27. Apple sends these when it detects activity consistent with mercenary spyware, and it does not say who is behind the attack. Citizen Lab treats such a notification as a high-confidence sign a phone was likely targeted. It has not said whether Bajić's phone was actually infected. Forensic analysis is ongoing.

In December 2025, prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and falsifying documents in the case, according to the Associated Press. Those are allegations, and no verdict has been reported. Bajić says he was removed from the investigation in November 2025 without explanation. In February he spoke about the case at a student-called protest outside the Constitutional Court.

The Guardian has reported that Serbian President Aleksandar Vučić allegedly pressed officials to strip the building's protection so Kushner's Affinity Partners could develop it into a Trump hotel. The Guardian's report is the basis for that claim in this reporting. Nothing in Citizen Lab's note ties Kushner, Trump or Affinity Partners to the spyware.

Bajić told SHARE that his involvement in the case was, in his view, "the sole reason for this unlawful spyware attack."

A growing list of targets

The two new cases bring the number of Serbian civil-society figures publicly known to have been targeted or infected with mercenary spyware to at least 16, per Citizen Lab. In September, SHARE, with support from the lab and Amnesty International's Security Lab, documented at least 14 people targeted in 2026. They included protest-movement members, activists, opposition party members, a member of parliament and a local government official.

SHARE said the timing of those cases coincided with the run-up to Serbia's March 29 local elections. One case involved a student protester whose iPhone was hacked with Pegasus. Amnesty's Security Lab separately found repeated use of homegrown Serbian government spyware against protesters.

"There's been increasing physical and digital repression," Ristić said. "The targeting has been very broad, not just in the sense of spyware." She added that confidential communications are leaking and journalists are being attacked. "The tensions are very high at this moment."

Who answers for it

Pegasus is sold by NSO Group to governments. A spokesperson for NSO and one for the Serbian embassy in Washington did not respond to requests for comment from The Record.

Citizen Lab has not attributed the Đokić infection to any government or operator. Spying on a university head, a prosecutor and student protesters is a serious charge if a state is behind it. That question is still open. The lab's note does not say who bought this access.

Next up: Citizen Lab's analysis of Bajić's device is still underway, and a further report is expected. Serbia holds parliamentary elections Oct. 25.