The iPhone of Vladan Đokić, rector of the University of Belgrade and one of the most prominent backers of Serbia’s student protest movement, was hacked with NSO Group’s Pegasus spyware in 2026 through a zero-click exploit that needed no action from him.
The finding was published on 19 October 2026 by the University of Toronto’s Citizen Lab together with the Serbian digital rights group SHARE Foundation. The same report reveals that Apple warned Rade Bajić, a prosecution aide who worked on the corruption case over a Kushner-linked Trump Tower project in Belgrade, that he had likely been targeted with mercenary spyware.
The disclosure comes six days before Serbia’s snap parliamentary elections on 25 October. It raises the number of Serbian civil society figures publicly known to have been targeted or infected with mercenary spyware to at least 16.
Zero-click Pegasus infection on the rector’s iPhone
Citizen Lab analysed forensic artifacts from Đokić’s iPhone at his request and concluded “with high confidence” that Pegasus had infected it. In a zero-click attack, the victim does not tap a link or open a file. The exploit runs silently, and Pegasus can then give its operator access to messages and location and can switch on the microphone and camera. The researchers have not said when in 2026 the infection occurred or which iOS flaw was exploited.
Andrijana Ristić, a researcher at SHARE, told CyberScoop that the case is the second confirmed Pegasus infection in Serbia this year. She would not say when it was discovered, citing the sensitivity of the investigation.
Đokić, an architect, has led the university since 2021. He refused to help the government crack down on protesting students, and pro-government media have cast him as a driving force behind the movement.
On 31 March 2026, authorities raided his offices and reportedly seized computers and servers. Until September, he was widely tipped to head the Student List in the elections. In a statement published by the Serbian daily Danas, Đokić called the spyware another attempt at intimidation aimed at silencing critical voices. He urged academics, the public and international organisations to demand full accountability.
Apple warned the prosecutor in the Trump Tower case
Rade Bajić is a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organised Crime (TOK). He received an Apple Threat Notification on 13 August 2026 and a reminder on 27 August. Citizen Lab treats these alerts as a high-confidence sign of targeting by spyware such as Pegasus. However, the specific tool aimed at his phone has not been identified, and the forensic analysis is still underway.
Bajić worked on the “Generalštab” case. It concerns the removal of heritage protection from Belgrade’s former Yugoslav army General Staff headquarters, which was to be redeveloped into a roughly $500 million Trump-branded hotel and residential complex by Affinity Partners, Jared Kushner’s investment firm. Bajić says he was taken off the case in November 2025 without explanation.
In February 2026, he spoke at a demonstration against political interference in the case. Aleksandar Vučić, who stepped down as president in September to run for prime minister, has publicly called him a criminal. “In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić told CyberScoop.
On 15 October, The Guardian published documents indicating that Vučić personally pressed heritage officials to lift the site’s protected status. The culture minister has been charged in the case, but Vučić has not been charged and denies wrongdoing. Kushner’s representatives and the Trump Organisation deny any improper deal or involvement in the decision. Apple’s warning reached Bajić about two months before those documents placed Vučić at the centre of the case from which Bajić had been removed.
NSO Group says it sells Pegasus only to government agencies and that its exports comply with Israeli export-control law, BBC News Serbian reported. “When you find Pegasus, you’ve found a government hacking operation,” Citizen Lab senior researcher John Scott-Railton told the BBC. Serbian authorities did not immediately comment, according to the Associated Press. They have denied responsibility for earlier spyware cases.
The new cases follow SHARE’s September disclosure that at least 14 students, activists and opposition politicians had been targeted with Pegasus and a new version of the NoviSpy Android spyware in the run-up to Serbia’s 29 March local elections. That investigation produced the country’s first confirmed Pegasus infection on the phone of student Jelena Kontić.
In December 2024, Amnesty International documented Serbian police using NoviSpy and Cellebrite phone-unlocking tools against journalists and activists. The revelations later led members of the European Parliament to call for a slowdown of Serbia’s EU accession talks.
Ordinary iPhone users do not need to take any action. Anyone who receives an Apple threat notification should seek expert help promptly. In Serbia, that means SHARE Foundation, and elsewhere, Access Now’s Digital Security Helpline. Citizen Lab also advises people at higher risk to turn on Lockdown Mode and keep their devices updated.
Citizen Lab says both investigations are ongoing and has not attributed the Đokić infection to a specific Serbian agency. On 18 October, Serbia’s student movement said its meetings were being monitored and alleged that authorities planned to detain some of its members before a major rally on 22 October.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
