A university rector who refused to help disperse student demonstrators and a prosecutor who investigated a Belgrade property deal were both carrying spyware weeks before Serbian elections, researchers said on October 19.
Two names added to a growing list
The Citizen Lab, working with Belgrade digital rights group SHARE Foundation, found with high confidence that NSO Group’s Pegasus infected the iPhone of Vladan Djokic, rector of the University of Belgrade. The intrusion needed no input from him: it ran as a zero-click chain, so nothing had to be tapped or opened.
SHARE researcher Andrijana Ristic said the Djokic case is the second confirmed Pegasus infection in Serbia this year. The known tally of targeted or compromised civil society figures now stands at 16, up from 14 documented in September.
A notification rather than a forensic find
Rade Bajic, a senior associate at the organized crime prosecutor’s office, worked on an inquiry into a $500M tower planned for a protected historic site. He was removed from the case in November 2025 without explanation and later spoke publicly about political interference.
His device was never forensically reconstructed. Instead he received an Apple Threat Notification on August 13, with a reminder two weeks later. The system flags accounts Apple believes a government has singled out for mercenary surveillance, and the researchers treat such an alert as a strong targeting signal rather than proof of which vendor was used.
Why the alert matters to any iPhone owner
Notifications arrive on the lock screen and by email, and Apple declines to explain what triggered them, since doing so would teach operators how to evade detection. Recipients are advised to seek expert help.
The researchers urged anyone potentially exposed to enable Lockdown Mode and have close contacts screened, since targeting often extends to family and colleagues.
