### Serbian Rector's iPhone Compromised by Pegasus Spyware The **Citizen Lab**, a prominent research group at the University of Toronto, has confirmed that the iPhone belonging to **Vladan Đokić**, Rector of the University of Belgrade, was infected with **NSO Group's Pegasus** spyware in 2026. The infection, a zero-click exploit, meant Đokić's device was compromised without any interaction from him. This revelation surfaced on October 19, just six days before Serbia's October 25 snap parliamentary election. While **Citizen Lab** confirmed the infection with high confidence, the exact date within 2026 and the identity of the attacker remain undisclosed as the investigation continues.  ### Broader Targeting of Serbian Civil Society This incident is not isolated. **Citizen Lab**'s findings, conducted in collaboration with the Serbian digital-rights group **SHARE Foundation**, extend an earlier wave of reported spyware cases in Serbia. A second notable case involves **Rade Bajić**, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime. Bajić, who worked on the high-profile "Generalštab" corruption investigation linked to a **Jared Kushner** property project, received **Apple Threat Notifications** on August 13 and August 27. These alerts indicate potential targeting by mercenary spyware, which **Apple** issues when it detects activity consistent with such attacks. While forensic analysis of Bajić's device is ongoing, **Citizen Lab** considers an **Apple Threat Notification** a strong indicator of targeting. The "Generalštab" case itself involves allegations of abuse of office and falsification of documents to remove heritage protection from a former army complex in Belgrade. ### The Pervasiveness of Pegasus and NoviSpy **Pegasus** spyware grants its operators extensive control over an infected device, mirroring the owner's access to private messages, encrypted communications, and the ability to covertly activate the microphone and camera. Đokić described the spyware on his phone as "another attempt of intimidation" and called for an independent investigation. The **Security Information Agency (BIA)**, Serbia's civilian security service, previously dismissed allegations of spying on students and opposition politicians as "purely trivial sensationalism," asserting adherence to Serbian law. Beyond **Pegasus**, other spyware variants are also in play. In September, **SHARE Foundation** reported at least 14 individuals in Serbia, including student activists and opposition politicians, had been targeted since the beginning of the year. **Jelena Kontić**, a student, had her **Pegasus** infection confirmed by **Citizen Lab**. Two other individuals were found to have a new version of **NoviSpy**, an Android spyware, installed on their phones. **Amnesty International** reported in December 2024 that **NoviSpy** was configured to send stolen data to a server whose IP address belonged to the **BIA**. This spyware was reportedly installed on activists' and journalists' phones during police questioning after devices were unlocked with **Cellebrite** forensic tools.  ### Recommendations for At-Risk Individuals While the specific flaw used against Đokić's phone and whether current iOS releases block it remain unknown, **Citizen Lab** provides crucial advice for individuals at risk: * **Enable Lockdown Mode** on your iPhone and ensure **iOS** is always up to date. * If you receive an **Apple Threat Notification**, assume your phone is infected until an expert confirms otherwise. Seek immediate assistance from organizations like **SHARE Foundation** in Serbia or **Access Now's Digital Security Helpline** elsewhere. * Extend spyware screening to close contacts, including family members and colleagues, as they may also be targeted.