Citizen Lab Confirms Zero-Click Pegasus Infection on Belgrade University Rector

The University of Belgrade's rector, Vladan Đokić, had his iPhone compromised with NSO Group's Pegasus spyware in 2026, according to research published by the Citizen Lab on October 19. The disclosure landed just six days before Serbia's October 25 snap parliamentary election, a timing that places the finding squarely in the middle of a politically charged campaign period.

Đokić is a prominent public supporter of Serbia's student protest movement, which has mobilized large demonstrations against the government over the past year. That profile — an academic figure with a visible political stance — fits a pattern Citizen Lab has documented repeatedly in Pegasus cases worldwide.

How the Infection Worked

The compromise relied on a zero-click exploit chain. In practical terms, this means the target never had to tap a link, open an attachment, or grant a permission prompt. The spyware was delivered and installed without any interaction from Đokić, which removes the most common defensive opportunity available to a high-risk individual: user vigilance.

Zero-click delivery is the hallmark of Pegasus's most advanced iterations. It typically abuses memory corruption vulnerabilities in messaging or media-parsing components, allowing an attacker to achieve code execution remotely. Because there is no visible artifact for the victim to notice, detection generally depends on forensic analysis of device logs, network traffic anomalies, or the identification of known Pegasus indicators by specialist researchers.

Why the Timing Matters

The six-day gap between the Citizen Lab report and the election is significant. Spyware disclosures involving political figures during election windows raise questions about surveillance intent that go beyond technical compromise. Đokić's alignment with the student protest movement — a movement that has become a central fault line in Serbian politics — makes him a plausible target for actors seeking insight into opposition organizing.

It is important to be precise about what the report establishes and what it does not. Citizen Lab confirmed the infection. Attribution of who deployed the spyware is a separate question, and Pegasus is a commercial product sold to government clients, not an open tool. NSO Group has consistently stated that its products are licensed only to vetted government agencies for counterterrorism and law enforcement purposes, and that it investigates credible abuse allegations.

The Broader Pegasus Problem

This case is the latest in a long series of Pegasus findings on civil society targets. Over the years, Citizen Lab and Amnesty International's Security Lab have documented infections on journalists, human rights defenders, lawyers, opposition politicians, and academics across multiple continents. The recurring theme is that commercial spyware has become a tool of political surveillance, not merely a counterterrorism instrument.

For defenders, the case reinforces several uncomfortable realities:

  • Mobile devices remain the softest target for high-value individuals. A phone carries location history, encrypted messaging, contacts, and live microphone access.
  • Zero-click exploits neutralize user education. Telling a target not to click suspicious links does nothing against an exploit chain that requires no click.
  • Detection is asymmetric. Victims rarely discover Pegasus themselves. Discovery usually comes from third-party forensic investigation, often triggered by journalistic or civil society referral.

Defensive Takeaways for High-Risk Individuals

While no single control reliably defeats a zero-click chain, layered measures still raise cost and improve detection odds. High-risk users should keep iOS fully patched, enable Lockdown Mode on Apple devices (which restricts attack surface at the cost of some functionality), reboot devices regularly, and avoid maintaining sensitive communications on a single device. Organizations supporting at-risk individuals should budget for forensic examination of devices when compromise is suspected, and should treat sudden device anomalies — unexpected reboots, battery drain, or data usage spikes — as a trigger for investigation rather than noise.

What Comes Next

Expect pressure on Serbian authorities to explain whether domestic agencies acquired or used Pegasus, and expect NSO Group to face renewed questions about client vetting. Citizen Lab's technical indicators will likely be used by other researchers to scan for related infections among Serbian civil society, which could reveal whether Đokić was an isolated target or part of a wider campaign.

For the security community, the case is a reminder that commercial spyware is not a distant geopolitical abstraction. It is an active, deployed capability that has repeatedly landed on the phones of people whose only offense was political visibility.

Read the original report: The Hacker News — Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election