"NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression." — John Scott‑Railton, senior researcher at The Citizen Lab
SHARE Foundation and The Citizen Lab confirm Pegasus infection in 2026
Researchers from the Serbian digital rights group SHARE Foundation and The Citizen Lab at the University of Toronto announced that one device used by a prominent Serbian critic was infected with NSO Group’s Pegasus spyware in 2026. The Citizen Lab report says the infection was identified "with high confidence" and "leveraged a zero-click exploit," meaning no user action such as clicking a link or opening a file was necessary for the compromise. Andrijana Ristić, a SHARE Foundation researcher who led the initial forensic work, said this case represents the second confirmed Pegasus infection in Serbia this year.
Vladan Ðokić — university leader and protest supporter targeted
The infected device belonged to Vladan Ðokić, rector of the University of Belgrade and a prominent figure in the student-led protest movement that followed the 2024 Novi Sad railway station canopy collapse. Ðokić, an architect and former dean of the university’s Faculty of Architecture, has publicly backed those anti‑corruption protests and has had direct confrontations with state authorities: Serbian police raided his offices in March and reportedly seized computers and servers. After that raid Ðokić accused authorities of trying to humiliate the institution, saying police entered "without prior notice or clear legal grounds." He was unavailable for comment to the reporting organizations.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRade Bajić — prosecutor’s office lawyer and ongoing investigation
Researchers also identified suspicious activity on the device of Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime who was part of the legal team prosecuting a high‑profile corruption case. Bajić told CyberScoop he believes his involvement in that case was the "sole reason" for what he described as an unlawful spyware attack; he pointed to news coverage and television programs in which the president referred to him as a "criminal" and part of a "gang that fabricated" the corruption case. SHARE and The Citizen Lab could not yet determine the exact spyware family on Bajić’s device; Ristić said Bajić had received an Apple threat notification and that the device’s analysis is ongoing.
Context: previous waves, NoviSpy, FinFisher and Hacking Team references
SHARE Foundation described in September what it called the largest documented wave of spyware surveillance in Serbia to date. That earlier wave involved 14 people, including a member of parliament and a local government official, and reportedly included infections with Pegasus as well as a new version of the NoviSpy Android spyware. Ristić traced the pattern of surveillance in Serbia back to earlier tools such as FinFisher and alleged dealings with Hacking Team, and she cited Amnesty International’s 2024 NoviSpy report that identified journalists, activists and civil society members as targets.
How technologists, policymakers, and the public are positioned
- Technologists and security teams: will be attentive to the technical detail that the confirmed Pegasus infection used a zero‑click exploit and that Apple’s threat notifications played a role in flagging at least one suspicious event. Ongoing forensic analysis by SHARE and The Citizen Lab underscores the value of device handoffs and cross‑lab confirmation.
- Policymakers and regulators: face an intersection of allegations — spyware detections, a high‑profile corruption prosecution tied to a $500 million development plan, and the proximity of national elections — all of which have been raised publicly in media reporting cited by the affected parties.
- End users, activists and legal professionals: are directly implicated; targets in prior reporting have included journalists, activists and civil society members, and the new cases involve a university rector and a public prosecutor’s office lawyer connected to politically sensitive matters.
Timing and stakes as Serbia approaches Oct. 25 parliamentary elections
The newly reported infections arrive with Serbia preparing for parliamentary elections on Oct. 25. The vote unfolds amid the student‑led protest movement, which has grown into what the reporting describes as the largest challenge in years to President Aleksandar Vučić’s rule. The reporting connects the spyware detections to the broader political moment: demonstrators’ anger over alleged government corruption, a contested $500 million hotel and residential tower project reported to involve Affinity Partners and public pressure tied to that development, and intensified scrutiny of surveillance techniques being used against critics.
The investigations remain active: SHARE and The Citizen Lab confirmed Pegasus on Ðokić’s device and continue to analyze Bajić’s device while tracing the longer history of spyware use in Serbia. With the parliamentary vote days away, those technical confirmations and unanswered questions about who deployed the tools and why sit at the center of a politically charged week.
