Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's election; prosecutor also targeted

Linha do tempo

1. citizenlab.ca ↗ · pub. 28/10/2026 11:26 · coletado 28/10 12:01

   Citizen Lab and SHARE Foundation confirm NSO Group Pegasus infection of University of Belgrade rector in 2026

   ler a análise desta fonte ocultar

   Citizen Lab, working with the SHARE Foundation, assessed with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the Serbian student movement, was hacked with NSO Group's Pegasus spyware in 2026. Separately, Rade Bajić, a prosecutor who investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification. Such notifications are high-confidence indicators of targeting with mercenary spyware like Pegasus. Citizen Lab says its investigations into both cases are ongoing.

   Technical Details

   The article gives no infection vector, exploit, CVE or IOCs. Attribution of the Đokić compromise to Pegasus is stated as high confidence. The Bajić case rests on the Apple Threat Notification alone, with no confirmed infection reported.

   Remediation

   The article gives no remediation guidance.

2. citizenlab.ca ↗ · pub. 27/10/2026 13:49 · coletado 27/10 15:01

   Pegasus spyware used against Serbian prosecutor and professor ahead of October 25 elections; at least 15 cases identified

   ler a análise desta fonte ocultar

   The Citizen Lab and SHARE Foundation found that a Serbian professor and prominent supporter of the country's student movement was targeted with Pegasus spyware, as reported by The Guardian. A Serbian prosecutor who investigated a scheme to help the Trumps build a tower in Belgrade was also targeted. The findings follow the Citizen Lab's earlier confirmation that a Serbian pro-democracy student activist's device was infected with Pegasus. At least 15 cases of Pegasus targeting have been identified ahead of Serbia's October 25 national elections.

   Technical Details

   The article gives no details on infection vectors, IOCs, CVEs or attribution to a specific operator. The only technical fact stated is that Pegasus was confirmed on the earlier activist's device.

3. securityaffairs.com ↗ · pub. 21/10/2026 02:57 · coletado 21/10 03:00

   NSO Group Pegasus zero-click infection of University of Belgrade rector confirmed six days before Serbian snap elections

   ler a análise desta fonte ocultar

   Citizen Lab, working with the SHARE Foundation, confirmed with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a prominent supporter of the Serbian student movement, was infected with NSO Group's Pegasus spyware in 2026. The infection used a zero-click exploit, so the victim took no action. The finding came six days before Serbia's snap parliamentary elections on October 25, and the investigation is ongoing. Citizen Lab did not attribute the attack, but Pegasus is sold only to governments and state agencies, which narrows the set of possible operators. Together with the earlier wave reported in September, at least 16 members of Serbian civil society have now been targeted or infected with commercial spyware in 2026.

   Technical Details

   • Citizen Lab analyzed forensic artifacts from Đokić's Apple iPhone, collected with his consent and with SHARE Foundation assistance.
   • Once installed, Pegasus gives its operator the same access as the device owner, including private and encrypted messages and covert activation of the microphone and camera.
   • Prosecutor Rade Bajić, formerly on the "Generalštab" corruption case, received an Apple Threat Notification on August 13 and a reminder on August 27. Citizen Lab treats this as a high-confidence indicator of likely targeting with mercenary spyware. Forensic analysis of his device is ongoing and infection is not confirmed.
   • Serbian authorities raided Đokić's offices on March 31 and seized computers and servers. Serbia's security service dismissed the September reports as sensationalism and said it operates within the law.
   • No IOCs or CVEs were published.

   Remediation

   • Treat any device that received an Apple Threat Notification as compromised until a technical expert confirms otherwise.
   • Enable Lockdown Mode on iPhone and keep iOS updated.
   • Have close contacts and colleagues screened.
   • Contact the SHARE Foundation in Serbia, or Access Now's Digital Security Helpline elsewhere.
4. thehackernews.com ↗ · pub. 20/10/2026 09:59 · coletado 20/10 11:00

   Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's snap election

   ler a análise desta fonte ocultar

   The Citizen Lab reported on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit and was confirmed with high confidence, but the lab gives no date within 2026, does not attribute the attack, and says its investigation is ongoing. A second case involves Rade Bajić, a senior associate at the Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption case. He received Apple Threat Notifications on August 13 and August 27, and forensic analysis of his device is ongoing. The two cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.

   Technical Details

   • The Citizen Lab analyzed forensic artifacts from Đokić's phone at his request, working with the SHARE Foundation.
   • The exploit was zero-click, requiring no interaction from the victim. The flaw used is not named, and the note does not say whether current iOS releases block it.
   • Pegasus gives its operator the same access as the phone's owner, including private and encrypted messages, and can switch on the microphone and camera covertly. This is per the lab's analysis of the September case.
   • The lab treats an Apple Threat Notification as a high-confidence sign of likely targeting. The note does not say whether Bajić's phone was infected.
   • Earlier wave: SHARE reported on September 2 that at least 14 people were targeted this year. Twelve received Apple notifications in August, and the lab confirmed a Pegasus infection on student Jelena Kontić. Two others had a new version of the Android spyware NoviSpy.
   • Amnesty International reported in December 2024 that NoviSpy sent stolen data to a server whose IP address belonged to the BIA, and that it was installed during police questioning after devices were unlocked with Cellebrite tools.
   • Attribution: no actor is named. Serbia's BIA dismissed the September allegations as "purely trivial sensationalism". Lawyers for Kontić filed a criminal complaint on October 6 against unidentified BIA and police individuals and NSO Group personnel.

   Remediation

   • There is no case-specific fix to install.
   • At-risk individuals should enable Lockdown Mode and keep iOS up to date.
   • Anyone who receives an Apple Threat Notification should assume the phone is infected until an expert has checked it, and seek help from the SHARE Foundation or Access Now's Digital Security Helpline.
   • Close contacts, such as family and colleagues, should also be screened for spyware.
5. cyberscoop.com ↗ · pub. 19/10/2026 07:00 · coletado 19/10 17:55 primeiro registro

   Pegasus zero-click spyware found on devices of Serbian University of Belgrade rector and prosecutor ahead of elections

   ler a análise desta fonte ocultar

   Researchers from the SHARE Foundation and The Citizen Lab report spyware on devices belonging to Vladan Ðokić, rector of the University of Belgrade and a prominent supporter of Serbia's student-led anti-corruption protests, and Rade Bajić, a lawyer with the Public Prosecutor's Office for Organized Crime. Citizen Lab confirmed with high confidence that Ðokić's device was infected with NSO Group's Pegasus in 2026 through a zero-click exploit. This is the second confirmed Pegasus infection in Serbia this year. Bajić's device was not attributed to a specific spyware family and that investigation is ongoing. The disclosures follow a September SHARE Foundation report documenting the largest known spyware wave in Serbia, and they come days before the 25 October parliamentary elections.

   Technical Details

   • Ðokić's device was infected with Pegasus in 2026, with high confidence per Citizen Lab. The infection used a zero-click exploit, so no user action was needed. The article gives no exploit chain, CVE or IOCs.
   • Bajić received an Apple threat notification, but SHARE and Citizen Lab could not determine which spyware infected his device. Analysis is ongoing.
   • The earlier September wave covered 14 people, including a member of parliament and a local government official. They were targeted with Pegasus and a new version of the NoviSpy Android spyware.
   • Surveillance in Serbia reportedly traces back to earlier tools such as FinFisher and alleged dealings with Hacking Team. Amnesty International's 2024 report first documented NoviSpy against journalists, activists and civil society.
   • The article does not attribute the operations to a specific operator. Bajić believes his work on a high-profile corruption case made him a target.

   Remediation

   The article gives no specific remediation guidance. It notes that Apple threat notifications served as an early warning in Bajić's case, and that forensic analysis by civil-society groups such as SHARE and Citizen Lab confirmed the infections.