Citizen Lab Confirms Pegasus on Belgrade University Rector’s iPhone
A Citizen Lab forensic analysis confirmed with a high degree of confidence that Belgrade University rector Vladan Đokić’s iPhone was infected with Pegasus spyware. The second disclosed case currently concerns the probable targeting of a prosecutorial official.
Research center Citizen Lab and Serbia’s SHARE Foundation said on October 19, 2026, that a forensic examination confirmed with a high degree of confidence a Pegasus infection on the iPhone of Belgrade University rector Vladan Đokić. According to the researchers, the infection involved commercial spyware and used a so-called zero-click exploit.
A zero-click attack does not require the victim to click a link, open an attachment, or perform any other interaction. Citizen Lab did not publish technical indicators of compromise or the specific vulnerability used in the attack. Therefore, it is not possible to determine whether a targeted fix is available for the exploit used.
Forensic Analysis Confirms Pegasus on Rector’s iPhone
Vladan Đokić is rector of Belgrade University and a supporter of the student movement. The disclosure comes ahead of parliamentary elections in Serbia scheduled for October 25, 2026.
A forensically confirmed infection represents stronger evidence than a threat notification alone. However, the report does not determine who carried out the attack, who operated Pegasus, or whether it was conducted by a Serbian state agency or another entity. These circumstances remain unclear.
Citizen Lab says the two newly disclosed cases raise the number of publicly known civil-society targets or infected individuals in Serbia in 2026 to at least 16. Based on the available findings, the documented group of targets therefore includes not only activists and students, but also academic and judicial circles.
The Second Case Is Not Yet a Confirmed Infection
Researchers also reported the case of Rade Bajić, a senior official with the Organized Crime Prosecutor’s Office. Bajić received two Apple Threat Notifications, on August 13 and 27, 2026. Citizen Lab assesses them as a strong indicator of probable targeting with commercial spyware.
However, his phone cannot be described as confirmed compromised. A forensic analysis of Bajić’s device has not yet been completed, and Citizen Lab has not yet reported a result confirming an infection. The difference between these cases is significant: for Đokić, researchers report a forensically verified infection; for Bajić, there are currently delivered security notifications and an ongoing examination of the device.
What Potentially At-Risk Individuals Can Do
For people who may be targets of similar surveillance, Citizen Lab recommends not delaying professional device checks, installing system updates, and using Lockdown Mode. These steps are relevant to reducing the risk of further attacks, but they do not change the fact that the historical compromise of Đokić’s phone has already been confirmed.
In Bajić’s case, the result of the forensic analysis will be important. Any response from Serbian authorities, a possible independent investigation, and whether Citizen Lab or Apple publish additional technical details, indicators of compromise, or information about a fix for the exploited vulnerability should also be monitored.
Sources
- Citizen Lab – The primary research report confirms with a high degree of confidence that Đokić’s iPhone was infected with Pegasus through a zero-click exploit and states that Bajić received an Apple Threat Notification while his forensic analysis continues.
- SHARE Foundation – The partner organization confirms the circumstances of the two new cases, distinguishes a confirmed infection from a notification of probable targeting, and provides context on earlier cases in Serbia.
- Associated Press – Independently corroborates Citizen Lab’s disclosure, the ongoing examination of Bajić’s device, and the lack of immediate comment from Serbian authorities.
Verified and updated: October 20, 2026 06:20
