Threat reportMalwareTL-2026-4022
NSO Group Pegasus Spyware Zero-Click Attack on University of Belgrade Rector Vladan Đokić Ahead of Serbian Snap Elections
NSO Group Pegasus Spyware Zero-Click Attack on University of (TL-2026-4022) is a high-severity malware campaign, first published 2026-10-21. It has no confirmed attribution, affects Apple iOS (iPhone 6 reported as the infected device), maps to 5 MITRE ATT&CK techniques (T1429, T1512, T1636), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4022
- Threat ID
- TL-2026-4022
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- education, government administration, judiciary, civil society
- Target regions
- serbia, Europe
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in NSO Group Pegasus Spyware Zero-Click Attack on University of
Malware and tooling: Chrysaor, NoviSpy, Cellebrite
How NSO Group Pegasus Spyware Zero-Click Attack on University of works
Citizen Lab, assisted by the SHARE Foundation, found with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a supporter of Serbia's pro-democracy student movement, was infected with NSO Group's Pegasus spyware in 2026 via a zero-click exploit. The finding was published six days before Serbia's October 25, 2026 snap parliamentary elections; the operator has not been identified.
Citizen Lab analyzed forensic artifacts from the Apple iPhone of Professor Vladan Đokić, Rector of the University of Belgrade, with assistance from the SHARE Foundation and at the victim's request and consent. It concluded with high confidence that the device was infected with NSO Group's Pegasus mercenary spyware in 2026 and that the infection used a zero-click exploit, meaning no click, file open or other action by the victim was required. The reporting describes the handset as an iPhone 6; the iOS version, exploit chain, CVEs and technical indicators were not published and the Citizen Lab investigation is described as ongoing. Pegasus is marketed by NSO Group only to governments and state agencies, and Citizen Lab did not name an operator. Once installed, Pegasus gives its operator access to messages and the ability to activate the microphone and camera without the owner's knowledge.
Đokić is a prominent backer of the student-led pro-democracy and anti-corruption campaign that began in November 2024 and was known for refusing to facilitate a government-led crackdown on protesters. His offices were raided on March 31, 2026 with computers and servers seized, and until September 2026 he was considered a possible head of the Student List for the October 25, 2026 snap elections. A second figure, senior prosecutorial associate Rade Bajić (Organized Crime Prosecutor's Office, formerly on the 'Generalštab' / Trump Tower corruption investigation), received Apple Threat Notifications on August 13 and August 27, 2026. Citizen Lab assesses these as a high-confidence indicator of mercenary spyware targeting; forensic analysis is ongoing and no infection has been confirmed on his device.
The case is part of a wider 2026 wave: SHARE Foundation, Citizen Lab and Amnesty International's Security Lab have documented at least 14-16 Serbian civil-society members targeted with mercenary spyware, including a student activist infected with Pegasus via a zero-click iMessage exploit (indicators spanning December 2025 to January 2026) and a rebuilt, harder-to-detect variant of the Serbian-made NoviSpy on a confiscated Android phone. Those other cases carried suspicion toward Serbia's Security Information Agency (BIA), but Citizen Lab has not attributed the Đokić infection to any operator. NSO Group and the Serbian embassy did not respond to press requests for comment. No CVEs, domains, IPs or file hashes were published for this case, so none are listed.
MITRE ATT&CK techniques used in TL-2026-4022
Collection
T1429 Audio Capture; T1512 Video Capture; T1636 Protected User Data
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in NSO Group Pegasus Spyware Zero-Click Attack on University of
- Apple — iOS (iPhone 6 reported as the infected device)
Vulnerable versions: Version not disclosed
Remediation for NSO Group Pegasus Spyware Zero-Click Attack on University of
Patches
- No CVE or vendor patch was identified in the public reporting; apply the latest Apple iOS security updates
Immediate actions
- Enable Apple Lockdown Mode on iPhones of at-risk individuals (activists, journalists, academics, judicial officials, opposition figures)
- Contact SHARE Foundation (Serbia) or the Access Now Digital Security Helpline for forensic screening of devices after an Apple Threat Notification
- Treat any Apple Threat Notification as a high-confidence indicator of mercenary spyware targeting and preserve the device for forensic analysis
- Notify close contacts of a confirmed target so they can seek spyware screening
Workarounds
- Lockdown Mode reduces the zero-click attack surface (for example message attachment and link preview handling)
- Reboot devices regularly and limit use of exposed messaging features on high-risk devices
Longer-term hardening
- Keep iOS and all Apple software on the latest release
- Establish a high-risk-user program with periodic mobile forensic checks for institutional leaders and civil-society staff
- Replace unsupported legacy devices such as the iPhone 6 that no longer receive current security updates
Timeline of NSO Group Pegasus Spyware Zero-Click Attack on University of
- Student-led anti-corruption and pro-democracy protests begin in Serbia (November 2024; exact day not stated in sources).
- Start of the December 2025 - January 2026 window of Pegasus infection indicators on a Serbian student activist's iPhone, delivered via a zero-click iMessage exploit (related case).
- Serbian local elections; a wave of spyware targeting of civil-society members coincides with this period.
- Serbian authorities raid Rector Đokić's offices and seize computers and servers.
- Prosecutorial associate Rade Bajić receives the first Apple Threat Notification.
- Bajić receives a second Apple Threat Notification; Citizen Lab assesses these as a high-confidence indicator of mercenary spyware targeting.
- Through September 2026 Đokić was considered a potential head of the Student List for the snap elections (month-level date).
- The Record reports the Citizen Lab / SHARE Foundation findings on Đokić and Bajić.
- Security Affairs reports that Citizen Lab found Pegasus on Đokić's iPhone via a zero-click exploit, six days before the elections; operator not identified.
- Serbian snap parliamentary elections scheduled.
Sources cited for NSO Group Pegasus Spyware Zero-Click Attack on University of
- NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
- Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures - The Citizen Lab
- New Spyware Cases: University of Belgrade and Prosecutor's Office Targeted - SHARE Foundation
- Two more Serbian opposition figures targeted with spyware, researchers say - The Record
- Spyware on Rector Đokić's and Prosecutor Bajić's phone - Vreme
- University of Belgrade rector infected with Pegasus, organized crime prosecution associate targeted - Crta
- Pegasus Spyware Hits Serbian University Rector Before Elections, Report Says - TechNadu
- Spyware found on the phones of rector Đokić and prosecutor Bajić - Serbian Monitor
- Pegasus and NoviSpy Used Against Serbian Protesters - Security Affairs
- Pegasus/NoviSpy variant spyware found on devices of Serbian activists - CyberScoop
Detection coverage for TL-2026-4022
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4022 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.