The phone of University of Belgrade Rector Vladan Đokić was infected with Pegasus spyware, while former prosecutor Rade Bajić received an alert indicating that he may have been targeted by similar surveillance technology, according to a report published Monday by Canadian research organization Citizen Lab.
The investigation was conducted in cooperation with the Belgrade-based SHARE Foundation. The findings add to a series of reported cases in which surveillance technology has allegedly been used against students, opposition politicians and activists in Serbia.
Pegasus Attack Required No User Interaction
Citizen Lab said it analyzed data from Đokić’s iPhone with his request and consent. Researchers concluded with a high degree of confidence that the device had been infected with Pegasus, spyware developed by Israeli company NSO Group, at some point in 2026.
The attack reportedly used a so-called zero-click exploit, which can compromise a device without the user clicking a link, opening a file or taking any other action.
Đokić has openly supported the student movement and refused to assist the authorities in their efforts against protesting students. He has subsequently faced significant pressure and attacks in pro-government media.
According to Citizen Lab, authorities searched his premises on March 31 and reportedly seized computers and servers. By September, Đokić had also been mentioned as a possible candidate to lead a student-backed electoral list in upcoming elections.
Former Prosecutor Suspects Link to General Staff Investigation
The second case concerns Rade Bajić, a former senior prosecutorial associate at Serbia’s Organized Crime Prosecutor’s Office who worked on a corruption investigation involving the former General Staff military complex in Belgrade.
The investigation concerns allegations that senior state officials unlawfully removed the complex’s cultural heritage protection status to facilitate a redevelopment project planned by a company associated with Jared Kushner, son-in-law of US President Donald Trump. Kushner’s company withdrew from the project late last year.
Bajić has said he was removed from the case in November 2025 without explanation. In February 2026, he publicly spoke at a protest about alleged political interference in the investigation.
According to Citizen Lab, Bajić received a threat notification from Apple on August 13 and a reminder on August 27. The organization considers such alerts a reliable indication that a device may have been targeted by mercenary spyware. However, neither Bajić nor Citizen Lab has established conclusively whether his phone was successfully hacked or how any potential attack was carried out.
“I believe my involvement in this case was the only reason for this illegal spyware attack,” Bajić told Reuters.
Apple confirmed to Reuters that it had sent a series of threat notifications to users on August 13 but did not directly address questions about the two cases. NSO Group, which says it sells its technology exclusively to governments, did not respond to inquiries.
The US government placed NSO Group on its Entity List in 2021. Serbian Interior Ministry officials have previously rejected allegations of cyber-espionage.
At Least 16 Civil Society Figures Reportedly Targeted
Last month, the SHARE Foundation reported that at least 14 people—including students, activists and opposition party members—had been targeted with advanced spyware ahead of local elections held on March 29. At least one device was reportedly infected with Pegasus.
With the two newly reported cases, Citizen Lab said the number of publicly known civil society representatives in Serbia who have been targeted by, or fallen victim to, mercenary spyware has reached at least 16.
The findings have renewed scrutiny of the use of commercial surveillance technology in Serbia, particularly amid tensions involving the student movement, opposition figures and investigations into alleged corruption at the highest levels of government.
