Pegasus found on Belgrade university rector's phone as Serbian spyware cases mount

The University of Belgrade's rector, Vladan Đokić, had his phone infected with NSO Group's Pegasus spyware at some point in 2026, the Citizen Lab confirmed on Monday, October 19, according to The Record. A second figure, prosecutor Rade Bajić, received an Apple threat notification in August, and his device is still being analyzed. The cases surface days before Serbia's October 25 elections.

What happened

The Record reports that the SHARE Foundation announced the two cases in a press release, with the Citizen Lab confirming the infection of Đokić's phone. Đokić supports the student protest movement that has demanded former president Aleksandar Vučić be permanently removed from government. According to the Citizen Lab, as cited by The Record, Serbian authorities raided Đokić's offices in late March 2026 and seized computers and servers after he refused to help crack down on student protesters.

Bajić's infection has not yet been confirmed. However, The Record notes that Apple threat notifications are generally considered strong indicators of commercial spyware targeting. Bajić had investigated a deal in which Vučić sought to sell a protected historic building in Belgrade to Jared Kushner for a Trump Tower project. He helped stop the deal and charged officials after finding forged documents, before being removed from the case in November 2025 without explanation. In March 2026, prosecutors indicted the current Minister of Culture and three other senior officials over the failed deal. Bajić told The Record that the case was the "sole reason" he was targeted and that the government was going after prosecutors investigating the executive branch.

A wider pattern

According to The Record, Amnesty International, the SHARE Foundation and the Citizen Lab have together found at least 15 people targeted with advanced spyware in Serbia in 2026. The outlet reports that Serbian authorities have used Pegasus against regime opponents for some time, and that several students and journalists have also been identified as targets. Student-led anti-corruption protests have been running in Belgrade since November 2024.

Vučić left the presidency due to term limits and is running for prime minister in the October 25 elections. NSO Group and the Serbian embassy in Washington did not respond to The Record's requests for comment.

What to do

Journalists, activists, academics and legal professionals in politically tense environments should treat Apple, Google or WhatsApp threat notifications as urgent and seek help from digital security organizations that can perform forensic checks. Keeping devices fully updated, rebooting phones regularly and enabling Apple's Lockdown Mode or Android's Advanced Protection can reduce exposure to zero-click spyware.