Pegasus Spyware Targets Serbian Academic and Legal Official Before Elections
Researchers confirm NSO Group’s spyware infected devices of prominent Serbian critics, marking the second known case this year as parliamentary votes approach.
Key points
- University of Belgrade rector Vladan Ðokić was infected with Pegasus via a zero-click exploit.
- Rade Bajić, a lawyer at the Public Prosecutor’s Office, was also targeted.
- This follows a September wave involving 14 targets, including an MP and local official.
Devices used by prominent Serbian political figures were infected with Pegasus spyware, according to findings announced Monday by the SHARE Foundation and The Citizen Lab at the University of Toronto. The surveillance targets include University of Belgrade rector Vladan Ðokić and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime.
The Citizen Lab report states with high confidence that NSO Group’s Pegasus was used to infect Ðokić’s device in 2026. The infection exploited a zero-click vulnerability, meaning the user did not need to click any links or open files. This technical method allows the spyware to install silently without user interaction or awareness.
Context of the surveillance
This incident represents the second confirmed Pegasus infection in Serbia this year, according to Andrijana Ristić, a researcher at the SHARE Foundation. It follows a larger wave of surveillance documented in September, which involved 14 individuals, including a member of parliament and a local government official. That earlier campaign utilized both Pegasus and a new version of NoviSpy Android spyware.
Who is affected
Vladan Ðokić has led the University of Belgrade since 2021 and publicly supported student-led anti-corruption protests following the 2024 Novi Sad railway station canopy collapse. Pro-government outlets have portrayed him as a key movement driver. In March, authorities raided his offices and seized computers and servers, an action he accused authorities of using to humiliate the institution without clear legal grounds.
Rade Bajić was part of the legal team prosecuting a corruption case involving government officials who approved a $500 million hotel and residential tower in a protected historic Belgrade site. The project was linked to former US President Donald Trump. The targeting of these two individuals occurs weeks before Serbia’s parliamentary elections.
Our take on the response
The SHARE Foundation conducted the initial forensic analysis before handing the device to The Citizen Lab for confirmation. Ristić declined to specify when the infection was discovered, citing the sensitive nature of the investigation. The use of a zero-click exploit in this case suggests that even highly cautious users who avoid clicking suspicious links remain vulnerable to sophisticated state-level spyware operations.
For customers and users
Individuals in high-risk positions should verify whether their devices show signs of unusual battery drain or unexpected data usage, which can indicate background spyware activity. If you suspect compromise, disconnect the device from the internet immediately to prevent further data exfiltration. Monitor your email and social media accounts for unusual login attempts or password reset requests, as attackers often use stolen credentials for follow-up scams.
Do not ignore security warnings or disable encryption features in an attempt to troubleshoot. Consult with a trusted cybersecurity professional for a forensic audit if you are a public figure or journalist, and ensure all software is updated to the latest version once the vendor provides an update to patch known vulnerabilities.
What to do and how to stay safe: Pegasus
- Check your device for unexpected battery drain or high data usage, which may signal hidden spyware.
- Enable two-factor authentication on all critical accounts to protect against credential theft.
- Keep your operating system and apps updated to patch known zero-click and click-to-install exploits.
- Be wary of phishing attempts that reference this incident to trick you into revealing sensitive data.
Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who were the specific individuals targeted by this Pegasus spyware campaign?
The confirmed targets are University of Belgrade rector Vladan Ðokić and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime.
How did the spyware infect the device without user interaction?
The infection leveraged a zero-click exploit, meaning no action such as clicking a link or opening a file was necessary for the spyware to install.
Is this the first time Pegasus has been found in Serbia this year?
No, this is the second confirmed Pegasus infection in Serbia this year, following a September wave that involved 14 other targets.
