Pegasus Zero-Click Spyware Found on Serbian Rector's iPhone Six Days Before National Election
In October 2026, Citizen Lab confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and prominent pro-democracy figure, was infected with NSO Group's Pegasus spyware via a zero-click exploit — requiring no user interaction whatsoever. The disclosure came just six days before Serbia's October 25 snap parliamentary election. A second case involved Rade Bajić, a senior prosecutor investigating a Kushner-linked Belgrade property scandal, who received Apple Threat Notifications in August 2026. These findings extend a documented wave of at least 16 civil-society targets in Serbia in 2026 alone, including student activists and opposition politicians, with earlier cases also involving the Android spyware NoviSpy linked to Serbia's civilian intelligence agency BIA. This incident reflects a sharp escalation in mercenary spyware deployment against democratic institutions and civil society ahead of contested elections. The pattern — zero-click exploits on fully updated devices, targeting lawyers, academics, and prosecutors — demonstrates that no device is inherently safe, and that network-level visibility and egress controls remain critical detection layers even when endpoint defenses are bypassed.
Kill Chain
