Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's election; prosecutor also targeted

Linha do tempo

1. securityaffairs.com ↗ · pub. 21/10/2026 02:57 · coletado 21/10 03:00

   NSO Group Pegasus zero-click infection of University of Belgrade rector confirmed six days before Serbian snap elections

   ler a análise desta fonte ocultar

   Citizen Lab, working with the SHARE Foundation, confirmed with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the Serbian student movement, was infected with NSO Group's Pegasus spyware in 2026. The infection used a zero-click exploit, so the victim took no action. The finding came six days before Serbia's snap parliamentary elections on October 25, and the investigation is ongoing. Citizen Lab did not attribute the attack, but Pegasus is sold only to governments and state agencies, which narrows the set of possible operators. Together with the earlier wave reported in September, at least 16 members of Serbian civil society have now been targeted or infected with commercial spyware in 2026.

   Technical Details

   • Citizen Lab analyzed forensic artifacts from Đokić's Apple iPhone, collected with his consent and with SHARE Foundation assistance.
   • Once installed, Pegasus gives its operator the same access as the device owner, including private and encrypted messages and covert activation of the microphone and camera.
   • Prosecutor Rade Bajić, formerly on the "Generalštab" corruption case, received an Apple Threat Notification on August 13 and a reminder on August 27. Citizen Lab treats this as a high-confidence indicator of likely targeting with mercenary spyware. Forensic analysis of his device is ongoing and infection is not confirmed.
   • Serbian authorities raided Đokić's offices on March 31 and seized computers and servers. Serbia's security service dismissed the September reports as sensationalism and said it operates within the law.
   • No IOCs or CVEs were published.

   Remediation

   • Treat any device that received an Apple Threat Notification as compromised until a technical expert confirms otherwise.
   • Enable Lockdown Mode on iPhone and keep iOS updated.
   • Have close contacts and colleagues screened.
   • Contact the SHARE Foundation in Serbia, or Access Now's Digital Security Helpline elsewhere.
2. thehackernews.com ↗ · pub. 20/10/2026 09:59 · coletado 20/10 11:00

   Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's snap election

   ler a análise desta fonte ocultar

   The Citizen Lab reported on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit and was confirmed with high confidence, but the lab gives no date within 2026, does not attribute the attack, and says its investigation is ongoing. A second case involves Rade Bajić, a senior associate at the Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption case. He received Apple Threat Notifications on August 13 and August 27, and forensic analysis of his device is ongoing. The two cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.

   Technical Details

   • The Citizen Lab analyzed forensic artifacts from Đokić's phone at his request, working with the SHARE Foundation.
   • The exploit was zero-click, requiring no interaction from the victim. The flaw used is not named, and the note does not say whether current iOS releases block it.
   • Pegasus gives its operator the same access as the phone's owner, including private and encrypted messages, and can switch on the microphone and camera covertly. This is per the lab's analysis of the September case.
   • The lab treats an Apple Threat Notification as a high-confidence sign of likely targeting. The note does not say whether Bajić's phone was infected.
   • Earlier wave: SHARE reported on September 2 that at least 14 people were targeted this year. Twelve received Apple notifications in August, and the lab confirmed a Pegasus infection on student Jelena Kontić. Two others had a new version of the Android spyware NoviSpy.
   • Amnesty International reported in December 2024 that NoviSpy sent stolen data to a server whose IP address belonged to the BIA, and that it was installed during police questioning after devices were unlocked with Cellebrite tools.
   • Attribution: no actor is named. Serbia's BIA dismissed the September allegations as "purely trivial sensationalism". Lawyers for Kontić filed a criminal complaint on October 6 against unidentified BIA and police individuals and NSO Group personnel.

   Remediation

   • There is no case-specific fix to install.
   • At-risk individuals should enable Lockdown Mode and keep iOS up to date.
   • Anyone who receives an Apple Threat Notification should assume the phone is infected until an expert has checked it, and seek help from the SHARE Foundation or Access Now's Digital Security Helpline.
   • Close contacts, such as family and colleagues, should also be screened for spyware.
3. cyberscoop.com ↗ · pub. 19/10/2026 07:00 · coletado 19/10 17:55 primeiro registro

   Pegasus zero-click spyware found on devices of Serbian University of Belgrade rector and prosecutor ahead of elections

   ler a análise desta fonte ocultar

   Researchers from the SHARE Foundation and The Citizen Lab report spyware on devices belonging to Vladan Ðokić, rector of the University of Belgrade and a prominent supporter of Serbia's student-led anti-corruption protests, and Rade Bajić, a lawyer with the Public Prosecutor's Office for Organized Crime. Citizen Lab confirmed with high confidence that Ðokić's device was infected with NSO Group's Pegasus in 2026 through a zero-click exploit. This is the second confirmed Pegasus infection in Serbia this year. Bajić's device was not attributed to a specific spyware family and that investigation is ongoing. The disclosures follow a September SHARE Foundation report documenting the largest known spyware wave in Serbia, and they come days before the 25 October parliamentary elections.

   Technical Details

   • Ðokić's device was infected with Pegasus in 2026, with high confidence per Citizen Lab. The infection used a zero-click exploit, so no user action was needed. The article gives no exploit chain, CVE or IOCs.
   • Bajić received an Apple threat notification, but SHARE and Citizen Lab could not determine which spyware infected his device. Analysis is ongoing.
   • The earlier September wave covered 14 people, including a member of parliament and a local government official. They were targeted with Pegasus and a new version of the NoviSpy Android spyware.
   • Surveillance in Serbia reportedly traces back to earlier tools such as FinFisher and alleged dealings with Hacking Team. Amnesty International's 2024 report first documented NoviSpy against journalists, activists and civil society.
   • The article does not attribute the operations to a specific operator. Bajić believes his work on a high-profile corruption case made him a target.

   Remediation

   The article gives no specific remediation guidance. It notes that Apple threat notifications served as an early warning in Bajić's case, and that forensic analysis by civil-society groups such as SHARE and Citizen Lab confirmed the infections.