NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections

Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026.
The infection utilized a zero-click exploit requiring no user action.
Citizen Lab and the SHARE Foundation found this infection with high confidence based on forensic artifacts from his iPhone.
Đokić is noted as a prominent figure in Serbia’s student-led pro-democracy movement for opposing a government crackdown.
Serbian authorities raided Đokić's offices on March 31, seizing equipment.
The discovery came six days before Serbia’s snap parliamentary elections on October 25.
Rade Bajić, a senior prosecutor, received an Apple Threat Notification on August 13 and a reminder on August 27.
Bajić worked on the "Generalštab" corruption case involving a development linked to Jared Kushner's son-in-law.
These two cases contribute to a known total of at least 16 targeted individuals in Serbian civil society in 2026.
Serbia’s security service dismissed September reports regarding attacks as trivial sensationalism.
Pegasus is sold exclusively to governments and state agencies, limiting potential operators.

<STEELMAN>The strongest interpretation supported by the findings is that targeted surveillance of prominent figures within Serbia's civil society—particularly those actively engaged in anti-government advocacy or investigative work—is occurring using sophisticated commercial spyware like Pegasus. Citizen Lab’s high-confidence findings regarding Đokić, combined with notifications received by prosecutor Bajić, suggest a pattern of state-adjacent intelligence gathering aimed at neutralizing political opposition and shielding potentially compromising investigations.</STEELMAN>
<PATTERN SCAN>The juxtaposition of the targeted individuals—a pro-democracy academic leader facing official scrutiny, and an investigator looking into corruption involving powerful international business ties—suggests a coordinated effort to suppress both civic dissent and accountability mechanisms. The timing relative to electoral cycles suggests information operations may be leveraged for political influence or deterrence. This aligns with ARC-0119 Pattern of Strategic Timing; specific high-stakes revelations are timed precisely around critical political inflection points (elections).</PATTERN SCAN>
<ROOT CAUSE>The underlying paradigm is the asymmetric application of advanced technological surveillance power, where access to tools like Pegasus translates directly into informational leverage over citizens and state actors alike. The unstated assumption driving this narrative is that digital life in politically sensitive environments equates to perpetually compromised visibility.</ROOT CAUSE>
<IMPLICATIONS>The cost borne here is a severe erosion of the practical space for robust civil society engagement; individuals are forced onto a defensive posture—treating their devices as inherently hostile rather than functional tools. Those who benefit are those capable of deploying or controlling such intelligence assets, while the risk falls disproportionately on activists and whistleblowers.</IMPLICATIONS>
<BRIDGE QUESTIONS>How does the official dismissal of these surveillance threats by Serbian security services compare against the technical assertions provided by independent cybersecurity researchers? If Pegasus is confined to state agencies, what mechanisms allow for this level of penetration into domestic political discourse without formal acknowledgment?</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN>A bad actor employing influence operations might frame this story as purely an incident of foreign interference (diversion) or a localized technological failure (minimization), thereby sidelining the systemic issue of state capacity to surveil dissent. The actual content, however, centers on actionable forensic findings tied to political actors, making it resistant to mere dismissal.</COUNTERSTRIKE SCAN>