# NSO Group Pegasus Spyware Zero-Click Attack on University of Belgrade Rector Vladan Đokić Ahead of Serbian Snap Elections

> Citizen Lab, assisted by the SHARE Foundation, found with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade and a supporter of Serbia's pro-democracy student movement, was infected with NSO Group's Pegasus spyware in 2026 via a zero-click exploit. The finding was published six days before Serbia's October 25, 2026 snap parliamentary elections; the operator has not been identified.

- **Published:** 2026-10-21T07:32:22Z
- **Last reviewed:** 2026-10-21T07:32:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4022
- **ID:** TL-2026-4022
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Citizen Lab analyzed forensic artifacts from the Apple iPhone of Professor Vladan Đokić, Rector of the University of Belgrade, with assistance from the SHARE Foundation and at the victim's request and consent. It concluded with high confidence that the device was infected with NSO Group's Pegasus mercenary spyware in 2026 and that the infection used a zero-click exploit, meaning no click, file open or other action by the victim was required. The reporting describes the handset as an iPhone 6; the iOS version, exploit chain, CVEs and technical indicators were not published and the Citizen Lab investigation is described as ongoing. Pegasus is marketed by NSO Group only to governments and state agencies, and Citizen Lab did not name an operator. Once installed, Pegasus gives its operator access to messages and the ability to activate the microphone and camera without the owner's knowledge.

Đokić is a prominent backer of the student-led pro-democracy and anti-corruption campaign that began in November 2024 and was known for refusing to facilitate a government-led crackdown on protesters. His offices were raided on March 31, 2026 with computers and servers seized, and until September 2026 he was considered a possible head of the Student List for the October 25, 2026 snap elections. A second figure, senior prosecutorial associate Rade Bajić (Organized Crime Prosecutor's Office, formerly on the 'Generalštab' / Trump Tower corruption investigation), received Apple Threat Notifications on August 13 and August 27, 2026. Citizen Lab assesses these as a high-confidence indicator of mercenary spyware targeting; forensic analysis is ongoing and no infection has been confirmed on his device.

The case is part of a wider 2026 wave: SHARE Foundation, Citizen Lab and Amnesty International's Security Lab have documented at least 14-16 Serbian civil-society members targeted with mercenary spyware, including a student activist infected with Pegasus via a zero-click iMessage exploit (indicators spanning December 2025 to January 2026) and a rebuilt, harder-to-detect variant of the Serbian-made NoviSpy on a confiscated Android phone. Those other cases carried suspicion toward Serbia's Security Information Agency (BIA), but Citizen Lab has not attributed the Đokić infection to any operator. NSO Group and the Serbian embassy did not respond to press requests for comment. No CVEs, domains, IPs or file hashes were published for this case, so none are listed.

## MITRE ATT&CK

- T1664 Exploitation for Initial Access
- T1429 Audio Capture
- T1512 Video Capture
- T1636 Protected User Data
- T1646 Exfiltration Over C2 Channel

## Sources

- [NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections](https://securityaffairs.com/201389/intelligence/nso-spyware-pegasus-hit-a-serbian-university-rector-six-days-before-snap-elections.html)
- [Targeting Democracy: Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures - The Citizen Lab](https://citizenlab.ca/research/pegasus-spyware-serbian-pro-democracy/)
- [New Spyware Cases: University of Belgrade and Prosecutor's Office Targeted - SHARE Foundation](https://sharefoundation.info/en/new-spyware-cases-university-of-belgrade-and-prosecutors-office-targeted/)
- [Two more Serbian opposition figures targeted with spyware, researchers say - The Record](https://therecord.media/serbia-spyware-pegasus-elections)
- [Spyware on Rector Đokić's and Prosecutor Bajić's phone - Vreme](https://vreme.com/en/vesti/spijunski-softver-telefon-rektor-djokic-tuziolac-bajic-pegasus/)
- [University of Belgrade rector infected with Pegasus, organized crime prosecution associate targeted - Crta](https://crta.plus/updates/university-of-belgrade-rector-infected-with-pegasus-organized-crime-prosecution-associate-targeted/)
- [Pegasus Spyware Hits Serbian University Rector Before Elections, Report Says - TechNadu](https://www.technadu.com/pegasus-spyware-found-on-belgrade-rectors-iphone-days-before-serbias-election-report-says/643010/)
- [Spyware found on the phones of rector Đokić and prosecutor Bajić - Serbian Monitor](https://www.serbianmonitor.com/en/spyware-found-on-the-phones-of-rector-dokic-and-prosecutor-bajic/)
- [Pegasus and NoviSpy Used Against Serbian Protesters - Security Affairs](https://securityaffairs.com/198377/intelligence/pegasus-and-novispy-used-against-serbian-protesters.html)
- [Pegasus/NoviSpy variant spyware found on devices of Serbian activists - CyberScoop](https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4022