Key points
- University of Belgrade rector Vladan Ðokić was infected with Pegasus spyware in 2026, according to Citizen Lab.
- Prosecutor Rade Bajić, involved in a high-profile corruption case, was also targeted with the same surveillance tool.
- The infection used a zero-click exploit, requiring no action from the victims to compromise their devices.
University of Belgrade rector Vladan Ðokić and senior prosecutor Rade Bajić have been confirmed as targets of Pegasus spyware, according to findings announced on Monday by the SHARE Foundation and The Citizen Lab. These infections were detected on devices belonging to prominent Serbian figures just weeks before parliamentary elections, highlighting a surge in digital surveillance against political critics.
The Citizen Lab report states with high confidence that Ðokić’s device was infected with NSO Group’s Pegasus in 2026. The infection leveraged a zero-click exploit, meaning no user interaction, such as clicking a link or opening a file, was necessary for the malware to install. This confirms the second known Pegasus infection in Serbia this year, as noted by SHARE Foundation researcher Andrijana Ristić.
Context of the surveillance
This incident follows a larger wave of spyware surveillance documented in September by the SHARE Foundation. That earlier campaign targeted fourteen individuals, including a member of parliament and a local government official, using Pegasus and a new version of NoviSpy Android spyware. The current findings extend that pattern of targeting high-profile critics and legal professionals during a period of significant political upheaval in the country.
Who is affected
Vladan Ðokić has led the University of Belgrade since 2021 and publicly supported student-led anti-corruption protests following the 2024 Novi Sad railway station canopy collapse. He has faced direct confrontations with the government, including a March raid on his offices where computers and servers were reportedly seized. Rade Bajić was part of the legal team prosecuting a corruption case involving a $500 million hotel project on a historic site in Belgrade.
Our take on the response
The use of zero-click exploits against public figures suggests that standard user caution is insufficient for defence. The fact that these infections occurred without any user interaction indicates sophisticated state-level or state-sponsored capabilities. For security teams, this underscores the need for advanced endpoint detection and strict isolation of high-risk devices, as traditional awareness training cannot mitigate attacks that require no user action.
What affected people can do
Individuals in high-risk roles should assume their devices may be compromised and seek immediate forensic analysis by trusted experts. They should avoid using potentially infected devices for sensitive communications or accessing critical accounts. Users should monitor for unusual device behaviour, such as unexpected battery drain or background noise, though zero-click attacks often leave no visible signs. It is crucial to verify the identity of anyone claiming to offer technical help, as scammers often exploit such incidents.
Background: Zero-click exploits
Zero-click exploits leave no user-interaction trace. Watch for sudden resource spikes, unexpected network connections, or silent process changes. Isolate the device immediately, preserve memory for analysis, and check for known vulnerability indicators before attempting remediation.
Read the full guide: Zero-Click Exploit Warning Signs and Immediate Response Actions
What to do and how to stay safe: Pegasus
- Assume any device that has been in contact with high-risk individuals is potentially compromised and isolate it from sensitive networks immediately.
- Monitor for anomalous device behaviour, such as unusual battery consumption or unexpected data usage, which may indicate background spyware activity.
- Use hardware-based encryption and strong, unique passwords for all accounts to limit the damage if a device is breached by zero-click exploits.
- Verify the legitimacy of any unsolicited technical support offers, as threat actors often follow breaches with targeted phishing or social engineering attempts.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who were the specific targets of the Pegasus spyware in this report?
The confirmed targets are Vladan Ðokić, rector of the University of Belgrade, and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime.
How did the Pegasus spyware infect the devices?
The infection leveraged a zero-click exploit, requiring no action from the user, such as clicking a link or opening a file, to compromise the device.
Is this the first time Pegasus has been found in Serbia?
No, SHARE Foundation researcher Andrijana Ristić stated this is the second confirmed Pegasus infection in Serbia this year, following a larger wave documented in September.