Forensic researchers have confirmed that the head of Serbia’s largest university was hacked with NSO Group’s Pegasus through an exploit that needed no interaction from him. A second case involving an anti-corruption prosecutor shows how mercenary spyware is being pointed at institutions, not just activists, in the days before a national election.
What happened
On 19 October 2026 the Citizen Lab at the University of Toronto, working with the Belgrade-based digital rights group SHARE Foundation, published a research note on two new spyware cases in Serbia. The first concerns Professor Vladan Đokić, Rector of the University of Belgrade. Analysis of artifacts from his iPhone, gathered with his consent, led the Citizen Lab to conclude with high confidence that the handset was compromised with Pegasus at some point in 2026, using a zero-click exploit.
Đokić has been a prominent backer of the student-led protest movement that grew out of the anti-corruption demonstrations which began in November 2024. According to the Citizen Lab, he declined to help the government crack down on students, and on 31 March 2026 authorities raided his offices and reportedly took computers and servers. Until September he was tipped to lead the Student List at the 25 October snap parliamentary election.
The second case is Rade Bajić, formerly a senior prosecutorial associate in Serbia’s organised crime prosecution office. He worked on the “Generalštab” investigation into a failed Trump Tower development in Belgrade, says he was removed from the case without explanation in November 2025, and later spoke out publicly about political interference. Apple sent him a threat notification on 13 August 2026 and a reminder on 27 August. The Citizen Lab treats that as a high-confidence sign he was targeted with mercenary spyware; its forensic work on his phone is still under way.
By the Citizen Lab’s count, at least 16 members of Serbian civil society are now on the public record as spyware targets or victims in 2026; The Record, citing SHARE’s press release, gave a slightly lower figure. NSO Group did not respond to The Record’s request for comment, and none of the sources attributes these two infections to a named government customer.
The technical picture
The detail that matters most to defenders is the delivery method. A zero-click exploit requires no tap, no link and no attachment: the victim does nothing wrong. The Citizen Lab has not published the specific chain used against Đokić, and its investigation is ongoing, so it would be speculation to name a particular flaw or iOS version.
What we can say is how the evidence was established. The Citizen Lab works from forensic artifacts collected from the device and, as in its earlier Pegasus investigations, looks for traces consistent with known infections. For Bajić, the evidence is different. Apple’s threat notifications draw on the company’s own detection and are intended for users it believes have been individually targeted by mercenary spyware, which is why researchers treat them as a strong indicator even before any device analysis is complete.
Context from SHARE adds a pattern. The foundation reported on 2 September that at least 14 people had been targeted in early 2026, including students, activists, an MP and a local councillor, with cases clustering around the March local elections. The new cases extend that targeting into a university leadership and a prosecutor’s office, timed against another vote.
Why it matters for UK organisations
It is tempting to file this under Balkan politics, but the tradecraft does not respect borders. The same commercial tools are sold to multiple governments, and the people they target are the sort who sit inside or alongside UK organisations: university leaders, legal professionals, investigative journalists, NGO staff, election workers and senior executives with access to sensitive negotiations. UK universities with partnerships or staff in Serbia and the wider region, law firms handling politically exposed matters, and media organisations with correspondents abroad all have people who fit this threat profile.
The Bajić case is a reminder that the target is often the role rather than the individual. A prosecutor working on a case involving senior officials is valuable because of what is on the phone: witness contacts, case strategy, internal discussions. UK organisations should think in the same terms about which roles would be worth a seven-figure exploit chain to a hostile state, and make sure those people get a different level of protection from the general workforce.
Corporate mobile device management is built for lost phones and data leakage, not for adversaries who can compromise a patched handset silently. Boards that assume enrolled, encrypted devices are enough are using the wrong threat model for these staff.
Expert view
In my experience, the hardest conversation with a client is explaining that some threats sit outside what a standard security programme is built to stop. You cannot train a user out of a zero-click exploit, and you will not see it in your mail gateway logs. When we run red team engagements, the mobile device of a senior individual is frequently the softest route to the crown jewels, and that is before you factor in an attacker with a government budget.
What defenders can control is attack surface and response. Apple’s Lockdown Mode deliberately strips out features, such as complex message attachments and certain web technologies, that have repeatedly provided the entry point for these chains. The Citizen Lab again recommends it for anyone at elevated risk, and it is free. The other lever is taking threat notifications seriously. A notification is not a false positive to be quietly dismissed; it should trigger an incident response process with specialist support, as the researchers urge, including checks on the devices of close colleagues and family.
What to do now
- Identify your high-risk roles. List staff whose work makes them a plausible state target: leadership, legal, communications, researchers in sensitive fields, and anyone travelling to or working with high-risk regions.
- Enable Lockdown Mode for that group. Pilot it with the individuals concerned, explain the trade-offs, and support exceptions properly rather than letting people quietly turn it off.
- Patch phones fast. Enforce the latest iOS and Android updates through device management, in line with the Cyber Essentials security update management control, and set short deadlines for high-risk users.
- Write a threat notification playbook. Decide in advance who a user tells, how the device is preserved, and which specialist forensic provider you will call. Do not wipe the phone first.
- Separate sensitive work from personal devices. Apply the Cyber Essentials secure configuration and access control principles: minimal apps, no unnecessary messaging services, and sensitive material kept off phones where possible.
Bottom line
A zero-click Pegasus infection on a university rector, alongside a likely attempt on an anti-corruption prosecutor, shows mercenary spyware being used against institutions as an election approaches. UK organisations cannot patch their way out of this class of threat alone, but they can find the people most at risk, cut down the attack surface of their phones and be ready to act the moment a threat notification lands.
