Citizen Lab has confirmed with high confidence that NSO Group’s Pegasus spyware infected the phone of Vladan Djokic, rector of the University of Belgrade, days before Serbia’s parliamentary elections on October 25. The lab announced the finding on Monday together with the SHARE Foundation.
Who Was Targeted: The University of Belgrade Rector and a Prosecutor
Citizen Lab said Djokic’s phone was infected with Pegasus in 2026. The SHARE Foundation carried out the initial forensic analysis and declined to say when the infection was discovered. Djokic has backed the student-led anti-corruption protests in Serbia. Serbian authorities raided his offices in March and reportedly seized computers and servers.
Prosecutor Rade Bajic and the Apple Threat Notification
A second person is also under review. Rade Bajic, a prosecutor with the Organized Crime Prosecutor’s Office, received an Apple threat notification in August. Citizen Lab is still analyzing his device. Bajic worked on a case involving a planned Trump Tower development in Belgrade tied to a Kushner deal, and he says the targeting is linked to that work.
A Second Confirmed Pegasus Infection in Serbia This Year
The Djokic finding is the second confirmed Pegasus infection in Serbia this year. SHARE, Citizen Lab and Amnesty have found at least 15 people targeted with advanced spyware in 2026. A September wave covered 14 people and included both Pegasus and a new version of NoviSpy, a spyware strain for Android devices.
Serbian Elections on October 25 and Vucic’s Run for Prime Minister
Serbia holds parliamentary elections on October 25. Former president Vucic is running for prime minister. NSO Group and the Serbian embassy did not comment in the reporting on the finding.
Attribution to the Serbian State Remains Circumstantial
The sources do not claim proof that the Serbian state carried out the targeting. Attribution to the state is circumstantial. Citizen Lab has not named a specific operator in this case. The analysis of Bajic’s device is continuing, and its results could add evidence on who deployed the spyware.
How the Timeline Unfolded From the March Raids to the Confirmation
The sequence of events spans most of the year. Serbian authorities raided Djokic’s offices in March. Bajic received his Apple threat notification in August. Citizen Lab and the SHARE Foundation announced the Djokic confirmation on October 19, and the vote follows on October 25. The SHARE Foundation has not said when the infection on Djokic’s phone was found, so the public record does not show how long the spyware may have been present before the announcement.
Citizen Lab’s high-confidence finding rests on forensic analysis that SHARE began and the lab confirmed. The lab’s analysis of the prosecutor’s device, which Citizen Lab is still examining, has not produced a finding yet.
What the Djokic Infection Means for NSO Group’s Sales Claims
The case raises questions about NSO Group’s statements that it does not sell to repressive governments. NSO has not responded to the findings, and the Serbian embassy has not commented either. Neither Citizen Lab nor SHARE has publicly named who operated the Pegasus infection on Djokic’s phone.
The timing adds weight to the story. The announcement comes in the final week before voting, and it involves a university head who backed protests and a prosecutor who handled a politically sensitive case. Two confirmed Pegasus infections in one country in a single year, within a wider group of at least 15 people targeted with advanced spyware, mark Serbia as an active surveillance concern for researchers who track these tools. Citizen Lab’s continuing work on the second device is the next development to watch, since a confirmed infection on Bajic’s phone would extend the count and could show whether the same operator targeted both men.
