Citizen Lab says Pegasus infected Serbian rector's iPhone before election

Past-week coverage · Original source published 2026-10-20.

Citizen Lab said on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware in 2026. Đokić is described as a prominent supporter of Serbia's student protest movement.

The disclosure came six days before Serbia's October 25 snap parliamentary election, according to the report. The infection is said to have used a zero-click exploit, meaning Đokić did not have to tap a link or take any other action for the spyware to be delivered.

The finding matters beyond one device. Pegasus infections of civil society figures and academics have repeatedly raised questions about who can deploy commercial spyware and against whom. The timing, days before a national vote, puts the case in that same debate over surveillance of political and public life.

The report attributes the finding to Citizen Lab. It does not say who operated the spyware, and no finding of state responsibility is established in the source. NSO Group has previously disputed misuse claims, though the retained source does not include a response in this case.

For defenders, the case is a reminder that zero-click mobile exploits leave little for a user to spot. High-risk individuals should keep iOS updated, enable lockdown-style protections where available, and seek forensic review of devices rather than relying on signs of unusual behavior.