Canadian cyber watchdog Citizen Lab and Serbia’s SHARE Foundation said Monday Pegasus had infected University of Belgrade Rector Vladan Đokić’s iPhone, while former prosecutor Rade Bajić told Reuters he received an Apple spyware warning.
The researchers said they examined Đokić’s phone data with his consent and assessed with high confidence that Pegasus had compromised it in 2026 through a zero-click exploit, which requires no action by the phone’s owner. They said their investigation is ongoing.
Bajić told Reuters he received an Apple Threat Notification on Aug. 13 and a reminder on Aug. 27. Citizen Lab said such alerts are a strong sign of possible targeting by mercenary spyware, but its forensic review of Bajić’s device is unfinished. The alert does not confirm that his phone was infected.
Bajić was a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. He told Reuters he believed his work on a case was the reason for an alleged spyware attack. The case involved allegations that officials improperly removed cultural protections from a historic military compound in Belgrade. Affinity Partners, an investment firm founded by Jared Kushner, had planned to redevelop the site before withdrawing from the project in late 2025, Reuters reported.
Citizen Lab said its count of people publicly identified in Serbia as targeted or infected is at least 16; that combined figure does not mean 16 infections were confirmed. The SHARE Foundation had earlier reported that at least 14 people had been targeted since early 2026, including students, activists and opposition party members.
The cases come amid nearly two years of student-led anti-corruption protests that have challenged Serbia’s ruling party, Reuters reported. Đokić had expressed solidarity with students and faced pressure from authorities, the outlet reported. The SHARE Foundation has warned that surveillance threatens the independence of prosecutors and universities, and argued that weak accountability could allow it to spread.
Reuters reported that Serbia’s Interior Ministry did not respond to a request for comment and NSO Group did not reply to its emails. NSO says it sells its tools only to governments and would end commercial ties over serious wrongdoing.
Serbia is due to hold a parliamentary election Sunday, Oct. 25.
