/
← Voltar ao feed
high education government legal civil_society

Pegasus zero-click spyware found on devices of Serbian University of Belgrade rector and prosecutor ahead of elections

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 07:00 · coletado há 1 dia

Researchers from the SHARE Foundation and The Citizen Lab report spyware on devices belonging to Vladan Ðokić, rector of the University of Belgrade and a prominent supporter of Serbia's student-led anti-corruption protests, and Rade Bajić, a lawyer with the Public Prosecutor's Office for Organized Crime. Citizen Lab confirmed with high confidence that Ðokić's device was infected with NSO Group's Pegasus in 2026 through a zero-click exploit. This is the second confirmed Pegasus infection in Serbia this year. Bajić's device was not attributed to a specific spyware family and that investigation is ongoing. The disclosures follow a September SHARE Foundation report documenting the largest known spyware wave in Serbia, and they come days before the 25 October parliamentary elections.

Technical Details

  • Ðokić's device was infected with Pegasus in 2026, with high confidence per Citizen Lab. The infection used a zero-click exploit, so no user action was needed. The article gives no exploit chain, CVE or IOCs.
  • Bajić received an Apple threat notification, but SHARE and Citizen Lab could not determine which spyware infected his device. Analysis is ongoing.
  • The earlier September wave covered 14 people, including a member of parliament and a local government official. They were targeted with Pegasus and a new version of the NoviSpy Android spyware.
  • Surveillance in Serbia reportedly traces back to earlier tools such as FinFisher and alleged dealings with Hacking Team. Amnesty International's 2024 report first documented NoviSpy against journalists, activists and civil society.
  • The article does not attribute the operations to a specific operator. Bajić believes his work on a high-profile corruption case made him a target.

Remediation

The article gives no specific remediation guidance. It notes that Apple threat notifications served as an early warning in Bajić's case, and that forensic analysis by civil-society groups such as SHARE and Citizen Lab confirmed the infections.

Linha do tempo

  1. cyberscoop.com ↗ · pub. 19/10/2026 07:00 · coletado 19/10 17:55 primeiro registro

    Pegasus zero-click spyware found on devices of Serbian University of Belgrade rector and prosecutor ahead of elections

    ler a análise desta fonte

    Researchers from the SHARE Foundation and The Citizen Lab report spyware on devices belonging to Vladan Ðokić, rector of the University of Belgrade and a prominent supporter of Serbia's student-led anti-corruption protests, and Rade Bajić, a lawyer with the Public Prosecutor's Office for Organized Crime. Citizen Lab confirmed with high confidence that Ðokić's device was infected with NSO Group's Pegasus in 2026 through a zero-click exploit. This is the second confirmed Pegasus infection in Serbia this year. Bajić's device was not attributed to a specific spyware family and that investigation is ongoing. The disclosures follow a September SHARE Foundation report documenting the largest known spyware wave in Serbia, and they come days before the 25 October parliamentary elections.

    Technical Details

    • Ðokić's device was infected with Pegasus in 2026, with high confidence per Citizen Lab. The infection used a zero-click exploit, so no user action was needed. The article gives no exploit chain, CVE or IOCs.
    • Bajić received an Apple threat notification, but SHARE and Citizen Lab could not determine which spyware infected his device. Analysis is ongoing.
    • The earlier September wave covered 14 people, including a member of parliament and a local government official. They were targeted with Pegasus and a new version of the NoviSpy Android spyware.
    • Surveillance in Serbia reportedly traces back to earlier tools such as FinFisher and alleged dealings with Hacking Team. Amnesty International's 2024 report first documented NoviSpy against journalists, activists and civil society.
    • The article does not attribute the operations to a specific operator. Bajić believes his work on a high-profile corruption case made him a target.

    Remediation

    The article gives no specific remediation guidance. It notes that Apple threat notifications served as an early warning in Bajić's case, and that forensic analysis by civil-society groups such as SHARE and Citizen Lab confirmed the infections.