Citizen Lab announced Monday that the iPhone of Vladan Djokic, rector of the University of Belgrade, was infected with Pegasus, the spyware built by the Israeli company NSO Group.

The finding landed less than a week before Serbia’s parliamentary election on Sunday, according to the Canadian research group and Reuters.

The Toronto-based lab also reported that Rade Bajic, a former prosecutor, received an Apple notification warning that his device had been targeted with mercenary spyware. Neither Bajic nor the researchers could say for certain whether his phone was actually breached.

Pegasus is marketed by NSO Group, an Israeli firm that says it supplies its tools only to government clients. Washington placed the company on a trade blacklist in 2021 after years of reports linking its products to human rights abuses.

Rector’s phone compromised through a zero-click attack

Working with the SHARE Foundation, a Serbian digital rights group, Citizen Lab concluded with high confidence that Djokic’s phone was compromised this year. The attack required no click or file opening from the victim. 

Forensic material was collected from the device at his request and with his consent, and the research group said its work on the case continues.

Djokic described the hacking as a grave violation of his privacy and security and of the office he holds, and demanded that those responsible face punishment.

He has been a prominent ally of the student movement that has challenged the government for nearly two years, and he refused to help authorities crack down on protesters. Police raided his offices on March 31 and reportedly took computers and servers. He had also been floated as a possible leader of the Student List in the October 25 vote, until September.

Prosecutor warned by Apple

Bajic worked in the organized crime prosecutor’s office in Belgrade and took part in an investigation into the redevelopment of a historic army compound known as Generalstab. Prosecutors examined whether senior officials improperly stripped the site of its cultural protection to clear the way for a project by an investment firm founded by Jared Kushner, son-in-law of US President Donald Trump. The firm withdrew late last year, saying it respected the wishes of the people of Serbia and Belgrade.

Bajic says he was taken off the case in November 2025 without explanation, and he spoke out against political interference at a protest in February. He received Apple’s warning on August 13 and a follow-up reminder on August 27. Citizen Lab treats such notifications as strong evidence of targeting, though its analysis of his device is still underway. 

Bajic told Reuters he believed his role in the case was “the sole reason for this unlawful spyware attack.” Apple confirmed it sent a round of threat notifications on August 13 but declined to address either man’s case.

16 known Serbian targets

The two cases bring the number of Serbian civil society figures publicly known to have been targeted or infected with mercenary spyware to at least 16, Citizen Lab said. Last month, the SHARE Foundation reported that at least 14 students, activists and opposition members were targeted ahead of March’s local elections, with Pegasus confirmed on at least one device.

Citizen Lab traced that infection to a student protester’s iPhone through an iMessage zero-click exploit, with signs of compromise dating to between December 2025 and January 2026.

Amnesty International’s Security Lab separately confirmed a new version of NoviSpy, a domestically developed tool, on two Android phones. Amnesty has previously attributed NoviSpy to Serbia’s Security Intelligence Agency, and it said the evidence suggests infections take place while activists are in detention.

Citizen Lab researcher John Scott-Railton said “Pegasus is still being used to hack people campaigning for democracy,” recalling that the spyware was first uncovered a decade ago against an Emirati activist. He added that the decisive evidence in such cases sits with the government operator.

Pegasus: A track record of hacking journalists

That first discovery involved Ahmed Mansoor, the Emirati human rights defender, in 2016. Pegasus was later found on the phones of journalists and activists in Mexico, and on devices belonging to people close to Saudi journalist Jamal Khashoggi, who was killed in 2018.

A 2021 investigation by Forbidden Stories and Amnesty, the Pegasus Project, examined a leaked list of more than 50,000 phone numbers of potential targets, among them journalists, opposition figures and officials in several countries. Palestinian civil society groups, which “Israel” had designated as terrorist organizations, were later found to have been hacked as well. Cases have also surfaced in Spain, Poland, Hungary, India and El Salvador.

In court, NSO has fared poorly. A jury ruled against the Israeli company in a lawsuit brought by WhatsApp over a 2019 hacking campaign.