A university rector’s phone, a prosecutor’s warning, and an Israeli export file that keeps reopening
Citizen Lab and the SHARE Foundation reported Monday that the Rector of the University of Belgrade was infected with NSO Group’s Pegasus during 2026. The victims are European; the vendor and the licensing question are not.
In a note published 19 October, John Scott-Railton, Bill Marczak and Ron Deibert of Citizen Lab found “with high confidence” that Professor Vladan Đokić, Rector of the University of Belgrade, was infected with Pegasus this year, with initial analysis conducted by Serbia’s SHARE Foundation. “The infection leveraged a zero-click exploit,” the researchers wrote. “No action, such as a click or opening a file was necessary for infection. Our investigation into this case is ongoing.” Serbian authorities raided Đokić's offices and seized computers and servers in late March 2026. A second figure, prosecutor Rade Bajić, received an Apple Threat Notification in August — an indicator of targeting, which the researchers are careful to distinguish from a confirmed infection. SHARE said surveillance of judicial staff and university officials “directly threatens the independence of institutions and their ability to work free from pressure.”
Citizen Lab puts the running total of Serbian civil society members publicly known to have been targeted or infected with mercenary spyware at “at least 16.” That figure has moved this year — earlier SHARE work supported by Citizen Lab and Amnesty International’s Security Lab counted at least 14, and The Record cites the press release as at least 15. The discrepancy is a counting-convention problem, not a dispute about facts, but it should be read as an approximate floor rather than a census. Lawyers for the student activist Jelena Kontić filed a criminal complaint with Serbia’s Prosecutor’s Office for High-Tech Crime on 6 October. Scott-Railton told CyberScoop: “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression.”
Assessment: Attribution here is inferred from context, not established forensically: Citizen Lab identifies the spyware, not the operator. Anyone reading the note as proof that Belgrade pulled the trigger is reading in something the researchers did not write. What makes this a desk item rather than a Balkans item is the supply side. Pegasus is licensed under Israeli export control, and the same week produced a second Israeli-vendor case in the Discover-Tech file above. CyberScoop reports MEPs have called for Serbia’s EU accession to be slowed over spyware use; we have not seen that letter. NSO has not responded to the Serbia findings.