Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Citizen Lab reports Pegasus on Belgrade rector's iPhone before vote

4 sources · 4 articlesFirst reported Updated ()2
What's new

October 20–21: The Hacker News dated Bajić’s Apple alerts to August 13 and 27 and put the public count at 16; Security Affairs reported a March 31 office raid and a security-service denial.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Citizen Lab reports a high-confidence 2026 Pegasus infection on Belgrade rector Vladan Đokić's iPhone; a prosecutor's suspected targeting remains unconfirmed before October 25 elections.

Citizen Lab said on October 19 it has high confidence that University of Belgrade rector Vladan Đokić's iPhone was infected in 2026 with NSO Group's Pegasus through a zero-click exploit. The lab did not identify the operator, date the infection within 2026, or say what was taken. Prosecutor Rade Bajić received Apple threat notifications on August 13 and August 27; researchers have not confirmed an infection, and analysis continues. He attributes the targeting to his Belgrade development case. The disclosure came six days before October 25 snap elections. CyberScoop reports a September wave covering 14 people; The Record cites a SHARE figure of at least 15 people targeted in 2026; The Hacker News says Citizen Lab's public Serbian count is now at least 16.

Key facts
  • Citizen Lab did not name the Pegasus operator or data taken from Đokić's iPhone.
  • Bajić's Apple alerts were August 13 and August 27; infection remains unconfirmed.
  • Authorities raided Đokić's offices on March 31, seizing computers and servers.
  • NSO Group and Serbia's Washington embassy did not comment, The Record said.
  • Serbia's security service called September spyware reports sensationalism, Security Affairs reported.
  • SHARE called the September wave the largest documented spyware surveillance in Serbia.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Mar 31, 2026Authorities raided Đokić's offices and seized computers and servers · Security Affairs
  2. Aug 13, 2026Bajić received his first Apple threat notification · The Hacker News
  3. Aug 27, 2026Bajić received a second Apple threat notification · The Hacker News
  4. Oct 6, 2026Lawyers for student Jelena Kontić filed a criminal complaint · The Hacker News
  5. Oct 19, 2026Citizen Lab reported a high-confidence Pegasus infection on Đokić's iPhone · The Hacker News
  6. Oct 25, 2026Serbia's snap parliamentary elections are scheduled · CyberScoop

What each outlet adds

beyond the shared facts
  • CyberScoopSeptember wave of 14; calls Đokić the second confirmed 2026 Pegasus case.
  • The RecordSHARE release of at least 15 targets; NSO and embassy did not comment.
  • The Hacker NewsPublic count at least 16; no operator or infection date; Kontić complaint.
  • Security AffairsMarch 31 raid; security service called September reports sensationalism.
Vendors
NSO GroupApple
Products
iPhone
Malware
PegasusNoviSpy
Victims
University of Belgrade
Organizations
Citizen LabSHARE FoundationSecurity Information AgencyAmnesty International
Countries
Serbia

Coverage

oldest first · one row per article · UTC
  1. · 6d ago CyberScoopFirst report

    Pegasus found on Serbian critics' phones before elections

    Citizen Lab reports a zero-click Pegasus infection on a Belgrade rector's phone in 2026; a prosecutor's spyware type is still unidentified.

  2. · 6d ago The Record

    Pegasus infected another Serbian opposition figure, researchers say

    Citizen Lab confirmed a Belgrade rector’s infection this year; a prosecutor’s phone is still being analyzed.

  3. · 5d ago The Hacker News

    Pegasus confirmed on Belgrade rector's iPhone before Serbia election

    Citizen Lab reports a high-confidence zero-click infection but does not name the operator, date, or flaw.

  4. · 4d ago Security Affairs

    Pegasus confirmed on Belgrade rector’s iPhone before elections

    Citizen Lab reports a high-confidence zero-click infection in 2026, bringing known Serbian civil-society spyware cases to at least 16.