Citizen Lab confirms Pegasus on Belgrade rector’s iPhone, operator unnamed

Citizen Lab published a research note on 19 October, authored by John Scott-Railton, Bill Marczak and Ron Deibert and produced with the Serbian digital rights group SHARE Foundation, finding with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026. The lab analysed forensic artifacts collected from Đokić's iPhone at his request and with his consent. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file. A second case in the same note concerns Rade Bajić, who as a prosecutor investigated official corruption in a failed project in Belgrade, and who received an Apple Threat Notification — an alert Apple sends when it detects activity consistent with an attack by mercenary spyware, and which the lab treats as a high-confidence sign that Bajić's phone was likely targeted.

The distinction matters and is being lost in the resulting coverage. Đokić's phone is forensically confirmed as infected. Bajić's phone is assessed as targeted. Per The Hacker News, summarising the note, the lab gives no date within 2026 for the infection, does not identify who was behind the attack, and says its investigation is ongoing. The cumulative count is the firmer number: investigations led by the SHARE Foundation with support from Citizen Lab and Amnesty International’s Security Lab found at least 14 people targeted with advanced spyware in Serbia in 2026 alone, and these two new cases raise the total to at least 16. CyberScoop reports this as the second confirmed Pegasus infection in Serbia this year, citing SHARE Foundation, which conducted the initial forensic analysis and declined to say when the infection was discovered, citing the sensitive nature of the investigation.

The election falls on 25 October, six days after publication. It was called in September after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. The SHARE Foundation described the 2026 pattern in September as the largest documented wave of spyware surveillance in the country to date. We have not obtained a response from NSO Group, from the Serbian government or from Apple, and note the absence rather than paper over it. Secondary coverage, notably by Tech Times, attaches further claims — about the nature of Bajić's corruption investigation, about a televised police raid on the rectorate, and about NSO’s current chairmanship — that we have not found in the primary note or in the wire and trade reporting, and which we are not printing.

Assessment: Read the gap between the two cases as the whole discipline of this field. A confirmed infection and a vendor warning notification are different evidentiary objects, and within forty-eight hours most aggregators had flattened them into one. The second gap is attribution: Citizen Lab names the tool and not the customer, which is the honest limit of forensic artifact analysis. Inference about who benefits six days before a vote is reasonable; it is not a finding, and anyone presenting it as one is doing politics. For this desk the Balkans detail is incidental. What recurs is the export chain — an Israeli vendor, a European government customer, a domestic critic — the same shape as the Morocco/DGST case Amnesty published on 3 October.