Pegasus found on Belgrade rector’s phone six days before Serbia votes

Citizen Lab published a research note on 19 October by John Scott-Railton, Bill Marczak and Ron Deibert finding “with high confidence” that the phone of Prof. Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the student protest movement, “was infected with NSO Group’s Pegasus spyware in 2026.” The forensics were carried out with Serbia’s SHARE Foundation at Đokić's request. “The infection leveraged a zero-click exploit,” the researchers told BalkanInsight. A second case, Rade Bajić, a prosecutor who investigated corruption in a failed Belgrade development project, received an Apple threat notification in August 2026; analysis of his device is ongoing and the note does not say whether it was infected. Andrijana Ristić of SHARE told CyberScoop this is the second confirmed Pegasus infection in Serbia this year, and declined to say when it was discovered. Serbia votes in a snap parliamentary election on 25 October.

Four things the report does not establish, and that are already being filled in elsewhere: who operated the spyware, when in 2026 the infection occurred, what was taken, and whether Bajić's phone was compromised at all. Citizen Lab names no operator. With these two cases, it counts 16 members of Serbian civil society publicly known to have been targeted or infected with mercenary spyware; a September wave documented by SHARE with Citizen Lab and Amnesty International’s Security Lab accounted for 14, included a sitting MP and a local official, and combined Pegasus with a new build of the domestic NoviSpy Android implant. On 6 October lawyers for student activist Jelena Kontić filed a criminal complaint with Serbia’s High-Tech Crime prosecutor alleging Pegasus was installed by Serbian security forces — an allegation, not a finding.

Assessment: This sits on a Middle East desk because the tool is an Israeli export, and because the week’s other spyware story shows how the sector’s delivery layer has moved. On 15 October Reuters reported Citizen Lab and Confiant findings that Israeli ad agency Discover-Tech gave Candiru and others access to Google, Comcast and Yandex ad inventory — 120,000-plus sites, ads that needed only to load, and 45 Windows devices at Al Jazeera compromised in 2024–25. Infection is drifting away from anything a target can decline to click. Resist the inference Citizen Lab refuses to make: targeting pattern is motive evidence, not attribution, and Belgrade’s election will not wait for the forensics.