The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.

The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work.

The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing.

The election was called in September after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people.

The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić's request, working with the Serbian digital-rights group SHARE Foundation. SHARE led the investigation of an earlier wave of Serbian cases made public in September.

A second case concerns Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption investigation into a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27.

Apple sends these alerts when it detects activity consistent with an attack by mercenary spyware, the commercial hacking tools that companies such as NSO sell to governments, and it does not say who is behind the attacks.

Source link