Spyware found on devices belonging to prominent Serbian critics as elections loom

Vladan Ðokić, rector of the University of Belgrade, was targeted with NSO Group’s Pegasus spyware in 2026 via a zero-click exploit.
Rade Bajić, a lawyer at Serbia’s Public Prosecutor’s Office for Organized Crime, reported being a target of spyware related to his legal work.
SHARE Foundation and The Citizen Lab conducted the research confirming the infections on the targeted devices.
The initial September surveillance wave included 14 people, targeting them with Pegasus and NoviSpy Android spyware.
Ðokić publicly supported student-led anti-corruption protests following the 2024 Novi Sad railway station canopy collapse.
Bajić was working on a corruption case concerning $500 million development on protected land in Belgrade involving government officials and Affinity Partners.
Andrijana Ristić, researcher at SHARE Foundation, stated this is the second confirmed Pegasus infection in Serbia this year.
The investigation into Bajić's device remains ongoing after he received an Apple threat notification.
Serbia will hold parliamentary elections on October 25.

The convergence of high-level political confrontation and technological surveillance reveals a deepening pattern wherein public dissent becomes immediate digital risk in Serbia. The narrative strongly positions NSO's Pegasus as a tool of state repression, linking its use directly to opposition figures—such as Ðokić, whose confrontations with authorities were well-documented, and Bajić, who is engaged in challenging high-level economic corruption allegations involving presidential circles. This aligns with the observation that activists are targeted during periods of heightened political friction preceding major elections. The underlying assumption driving this reporting is that sophisticated digital intrusion mirrors or precedes traditional methods of institutional pressure, such as raids on offices.
The implications suggest a chilling effect on civil society; if challenging powerful economic interests or state policy carries a measurable risk of undetectable espionage, agency is severely curtailed. Who benefits from the intimidation—those maintaining incumbent political stability or those controlling national resources? The cost is borne by the individuals acting as watchdogs against entrenched power. Furthermore, Ristić's reference to older tools like FinFisher suggests this is not an isolated incident but part of a systemic apparatus of observation.
This situation invites questions regarding the nature of digital sovereignty when state-adjacent actors utilize undetectable intrusions. How much evidence must be made public before surveillance becomes an operational tactic rather than merely political pressure? What checks remain against foreign intelligence entities or domestic security arms operating with such high technological capacity? If these methods are used selectively to silence critics near an election, does the democratic contest itself become compromised by pre-emptive digital censorship?
Patterns detected: none