Home · Wiki · Incidents & Campaigns
type: incident · created: 2026-10-20 · updated: 2026-10-20 · tags: [incident, defence, android] · confidence: medium · severity: low · affected_sectors: [defence] · au_impact: false

The Citizen Lab confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, using a zero-click exploit requiring no click or file opening. The finding, announced 19 October, came six days before Serbia's 25 October snap parliamentary election; the lab's note gives no date within 2026, names no attacker and says its investigation continues. The analysis was carried out at Đokić's request with the SHARE Foundation, which documented what it called Serbia's largest spyware wave to date in September — 14 people targeted with Pegasus and a new NoviSpy Android spyware, including a member of parliament and a local government official. The second new case concerns Rade Bajić, a senior prosecutorial associate who worked on the "Generalštab" corruption investigation into a Kushner-linked Belgrade property project and who received Apple Threat Notifications on 13 and 27 August; his forensic analysis is ongoing. Đokić called the infection "another attempt of intimidation" and demanded an independent investigation.

Attribute Detail
Sector Defence
Date 2026-10-20
Source CyberScoop
Reliability Tier 2