"Another attempt of intimidation," Vladan Đokić said, after researchers at the University of Toronto's Citizen Lab reported on October 19 that his iPhone had been infected with NSO Group's Pegasus spyware in 2026.
Vladan Đokić's iPhone: Pegasus infection confirmed days before the election
The Citizen Lab published its finding six days before Serbia's October 25 snap parliamentary election, saying it had high confidence that Đokić's device was infected. The lab reported the infection used a zero-click exploit — meaning Đokić did not have to tap a link or open a file for the intrusion to succeed — but the note gives no specific date in 2026 and does not identify who carried out the attack. The lab also did not say whether any data were removed from the phone.
The role of Citizen Lab and SHARE Foundation in the forensic review
The forensic analysis was carried out at Đokić's request by the Citizen Lab, working with the Serbian digital-rights group SHARE Foundation. SHARE led a wave of public disclosures in September and has been coordinating investigations into suspected mercenary-spyware cases in Serbia. The lab's analysis drew on artifacts from the device; its earlier analyses of other cases show that Pegasus can access private and encrypted messages and can switch on a phone's microphone and camera without the owner knowing.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRade Bajić, Apple Threat Notifications, and the Generalštab investigation
A second case the lab disclosed concerns Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organized Crime who worked on the "Generalštab" corruption investigation tied to a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends those alerts when its systems detect activity consistent with mercenary spyware; the alerts do not attribute attacks to any operator. The Citizen Lab treats an Apple Threat Notification as a high-confidence sign that Bajić's phone was likely targeted, though its forensic work on his device is ongoing and the lab's note does not say whether it was infected.
Pattern of targeting in Serbia and related investigations
The new cases follow SHARE's September 2 report that at least 14 people in Serbia — including student activists, an opposition MP and a local councilor — had been targeted with spyware since the start of the year. By the Citizen Lab's count, the two cases disclosed on October 19 raise that publicly known total to at least 16 people. In September the Citizen Lab confirmed a Pegasus infection on student Jelena Kontić's phone; two other people were found to have a new version of NoviSpy, an Android spyware. Amnesty International reported in December 2024 that NoviSpy had been configured to send stolen data to a server whose IP address belonged to the Security Information Agency (BIA), and that it had been installed on phones during police questioning after devices were unlocked with Cellebrite forensic tools.
What this means for technologists, prosecutors, and student activists
- Technologists and security teams: The lab's note did not name the specific iOS flaw used against Đokić or say whether current iOS releases block it, so there is no case-specific patch to install. The lab advised at-risk users to enable Lockdown Mode and keep iOS up to date, and to have close contacts screened as well.
- Prosecutors and legal actors: The Generalštab case has already seen criminal charges: in December 2025 prosecutors charged Culture Minister Nikola Selaković and three other officials with abuse of office and falsifying documents. Bajić says he was removed from the investigation in November 2025 without explanation and later spoke about the case at a February protest outside Serbia's Constitutional Court. The appearance of spyware targeting a prosecutor associated with that probe raises questions about the security of investigative teams and the integrity of evidence-handling processes.
- Student activists and civil-society figures: SHARE reported that many of those targeted are connected to the protests that began after the Novi Sad canopy collapse in November 2024. Đokić — a prominent supporter of the student protest movement and rector of the University of Belgrade — said police raided his offices on March 31 and seized computers and servers; he has demanded an independent investigation with results made public and whoever installed and used the spyware prosecuted.
The Serbian Security Information Agency (BIA) dismissed earlier September allegations as "purely trivial sensationalism" in a September 3 statement translated by broadcaster N1 and said it operates strictly within Serbian law. Lawyers for Kontić filed a criminal complaint on October 6 against unidentified individuals in the BIA and the police, and against people responsible at NSO Group; SHARE notes that Pegasus is sold only to governments and state agencies.
Two facts anchor the moment: the infection on Đokić's phone was confirmed with high confidence by an independent research lab during the run-up to a snap election, and the public record still lacks attribution, a technical patch tied to the exploit, or a published official investigation that attributes responsibility. Đokić has demanded a prompt, transparent probe; the lab and civil-rights groups have given clear, practical advice to people at elevated risk. Whether those steps will produce answers before October 25 remains an open question in the public record.
