/
← Voltar ao feed
high education government civil_society legal

Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's snap election

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 09:59 · coletado há 18 horas

The Citizen Lab reported on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit and was confirmed with high confidence, but the lab gives no date within 2026, does not attribute the attack, and says its investigation is ongoing. A second case involves Rade Bajić, a senior associate at the Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption case. He received Apple Threat Notifications on August 13 and August 27, and forensic analysis of his device is ongoing. The two cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.

Technical Details

  • The Citizen Lab analyzed forensic artifacts from Đokić's phone at his request, working with the SHARE Foundation.
  • The exploit was zero-click, requiring no interaction from the victim. The flaw used is not named, and the note does not say whether current iOS releases block it.
  • Pegasus gives its operator the same access as the phone's owner, including private and encrypted messages, and can switch on the microphone and camera covertly. This is per the lab's analysis of the September case.
  • The lab treats an Apple Threat Notification as a high-confidence sign of likely targeting. The note does not say whether Bajić's phone was infected.
  • Earlier wave: SHARE reported on September 2 that at least 14 people were targeted this year. Twelve received Apple notifications in August, and the lab confirmed a Pegasus infection on student Jelena Kontić. Two others had a new version of the Android spyware NoviSpy.
  • Amnesty International reported in December 2024 that NoviSpy sent stolen data to a server whose IP address belonged to the BIA, and that it was installed during police questioning after devices were unlocked with Cellebrite tools.
  • Attribution: no actor is named. Serbia's BIA dismissed the September allegations as "purely trivial sensationalism". Lawyers for Kontić filed a criminal complaint on October 6 against unidentified BIA and police individuals and NSO Group personnel.

Remediation

  • There is no case-specific fix to install.
  • At-risk individuals should enable Lockdown Mode and keep iOS up to date.
  • Anyone who receives an Apple Threat Notification should assume the phone is infected until an expert has checked it, and seek help from the SHARE Foundation or Access Now's Digital Security Helpline.
  • Close contacts, such as family and colleagues, should also be screened for spyware.

Linha do tempo

  1. thehackernews.com ↗ · pub. 20/10/2026 09:59 · coletado 20/10 11:00 primeiro registro

    Pegasus zero-click spyware confirmed on Belgrade University rector's iPhone days before Serbia's snap election

    ler a análise desta fonte

    The Citizen Lab reported on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit and was confirmed with high confidence, but the lab gives no date within 2026, does not attribute the attack, and says its investigation is ongoing. A second case involves Rade Bajić, a senior associate at the Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption case. He received Apple Threat Notifications on August 13 and August 27, and forensic analysis of his device is ongoing. The two cases bring the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware this year to at least 16.

    Technical Details

    • The Citizen Lab analyzed forensic artifacts from Đokić's phone at his request, working with the SHARE Foundation.
    • The exploit was zero-click, requiring no interaction from the victim. The flaw used is not named, and the note does not say whether current iOS releases block it.
    • Pegasus gives its operator the same access as the phone's owner, including private and encrypted messages, and can switch on the microphone and camera covertly. This is per the lab's analysis of the September case.
    • The lab treats an Apple Threat Notification as a high-confidence sign of likely targeting. The note does not say whether Bajić's phone was infected.
    • Earlier wave: SHARE reported on September 2 that at least 14 people were targeted this year. Twelve received Apple notifications in August, and the lab confirmed a Pegasus infection on student Jelena Kontić. Two others had a new version of the Android spyware NoviSpy.
    • Amnesty International reported in December 2024 that NoviSpy sent stolen data to a server whose IP address belonged to the BIA, and that it was installed during police questioning after devices were unlocked with Cellebrite tools.
    • Attribution: no actor is named. Serbia's BIA dismissed the September allegations as "purely trivial sensationalism". Lawyers for Kontić filed a criminal complaint on October 6 against unidentified BIA and police individuals and NSO Group personnel.

    Remediation

    • There is no case-specific fix to install.
    • At-risk individuals should enable Lockdown Mode and keep iOS up to date.
    • Anyone who receives an Apple Threat Notification should assume the phone is infected until an expert has checked it, and seek help from the SHARE Foundation or Access Now's Digital Security Helpline.
    • Close contacts, such as family and colleagues, should also be screened for spyware.