Pegasus infection confirmed on Serbian university rector's iPhone

The Citizen Lab says it found NSO Group’s Pegasus spyware on the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student-led pro-democracy movement. The lab said the infection was identified with high confidence and used a zero-click exploit, meaning Đokić did not need to tap a link or open a file.

What the investigation found

Citizen Lab analysed forensic artefacts from Đokić’s iPhone at his request, with assistance from Serbia’s SHARE Foundation. Its research note says the infection occurred in 2026, but does not identify who operated the spyware or provide a case-specific infection date. The investigation remains ongoing.

Đokić said in a statement published by the University of Belgrade that Citizen Lab and SHARE had confirmed spyware on his phone. He described the Pegasus infection as an attempt to intimidate him and called for an independent, transparent investigation into who installed and used it. The university rector has been a visible supporter of student protesters, and his offices were raided on 31 March, according to the research note and his earlier public remarks.

The same Citizen Lab report describes a second case involving Rade Bajić, a senior prosecutorial associate in Serbia. Bajić received Apple Threat Notifications on 13 and 27 August. Citizen Lab treats such a notification as a high-confidence sign that a device was likely targeted with mercenary spyware, although its forensic analysis of Bajić’s phone is still under way and the note does not say that Pegasus was found on it.

Together, the two cases raise to at least 16 the number of people in Serbian civil society publicly known to have been targeted or infected with mercenary spyware in 2026, according to Citizen Lab. The organisation says the wider cases include activists, opposition figures and members of the student protest movement. The findings do not identify the operator behind Đokić’s infection, and they do not establish that Serbian authorities were responsible.

What Apple users should know

Citizen Lab recommends that people who receive an Apple Threat Notification seek expert help immediately and have close contacts screened where appropriate. Apple’s own guidance also points people at heightened risk towards Lockdown Mode, an optional security setting that restricts some device functions to reduce the attack surface for highly targeted attacks. It is a defensive recommendation, not evidence that Lockdown Mode would have prevented this specific infection.

Our opinion

The clearest fact here is the forensic finding, not the unanswered question of who was behind it. A zero-click Pegasus infection on a university rector’s phone is serious, but responsible reporting has to keep the attribution gap visible: Citizen Lab has confirmed the malware and described the circumstances, while its investigation has not named an operator. The second case also shows why Apple’s threat notifications should be treated as urgent warnings rather than casual alerts, even when a forensic infection has not yet been confirmed.

For readers outside Serbia, the practical lesson is limited but useful. Keep devices updated, understand Apple’s threat-notification guidance and seek specialist help if such a notification arrives. There is no case-specific patch identified in this report, and no generic security setting can turn an unresolved investigation into a settled attribution.