Zero-click Pegasus found on Belgrade rector’s iPhone

The Citizen Lab at the University of Toronto has confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a public supporter of Serbia’s student movement, was infected in 2026 with Pegasus, NSO Group’s spyware. The infection used a zero-click exploit: no click, no opened file. The analysis was carried out together with the SHARE Foundation, a Serbian digital rights organisation, and made public on Monday 19 October, six days before the snap parliamentary elections of 25 October.

What happened

According to the Citizen Lab report, covered by CyberScoop, The Record and Security Affairs, the SHARE Foundation performed the initial forensic analysis of the device at the rector’s request and with his consent; the Citizen Lab then confirmed the presence of Pegasus. The SHARE Foundation has not said when the infection was discovered, citing the sensitivity of the investigation, which remains open. According to its researcher Andrijana Ristić, quoted by CyberScoop, this is the second confirmed Pegasus infection in Serbia this year.

The sources report a second case: Rade Bajić, a prosecutor at the Prosecutor’s Office for Organised Crime, who worked on a corruption investigation into a property project on a protected historic site in Belgrade. Bajić received an Apple Threat Notification: according to Security Affairs on 13 August, with a reminder on 27 August. The analysis of his device is still ongoing: neither the SHARE Foundation nor the Citizen Lab has been able to determine which spyware was used, and the infection is not confirmed.

The rector has called for an independent investigation, publication of its findings and prosecution of those responsible. NSO Group did not respond to The Record’s questions.

Technical details

• Tool: NSO Group’s Pegasus, on iPhone. No source states the iOS version affected or the vulnerability exploited: no CVEs have been published in connection with this case.
• Attack vector: a zero-click exploit, requiring no action by the victim. The delivery channel has not been disclosed.
• Capabilities: according to the Citizen Lab, once installed Pegasus gives its operator the same access as the device owner: private and encrypted messages, and the ability to switch on the microphone and camera without the person knowing.
• MITRE ATT&CK for Mobile (our mapping, based on the capabilities described): T1664 (Exploitation for Initial Access) for the zero-click entry, T1429 (Audio Capture) and T1512 (Video Capture) for microphone and camera.
• Indicators of compromise: none published by the sources.
• Attribution: the Citizen Lab has not said who is behind the attack. Security Affairs notes that Pegasus is sold only to governments and state agencies. Serbia’s security service, again according to Security Affairs, had dismissed the September reports as sensationalism and stated that it operates within the law.

Context: a long-running campaign

The two cases add to the wave documented in September by the SHARE Foundation with the Citizen Lab and Amnesty International. The sources give different figures: according to CyberScoop that wave involved 14 people, including a member of parliament and a local official, targeted with Pegasus and with a new version of NoviSpy, an Android spyware; The Record, citing the SHARE Foundation’s press release, speaks of at least 15 people targeted in 2026; Security Affairs, including the two new cases, puts the total at at least 16.

Ristić places surveillance in Serbia in a longer history, from FinFisher and alleged dealings with Hacking Team to Amnesty International’s first NoviSpy report in 2024, which identified journalists and activists among the targets.

Impact for European and Italian companies

Mercenary spyware does not strike at random: it picks people for their role. Here a rector and a prosecutor; elsewhere executives, lawyers, journalists, researchers, public officials. A smartphone compromised with a zero-click exploit exposes email, encrypted chats, authentication codes and meetings, without the user doing anything wrong: anti-phishing training alone is not enough.

For NIS2 entities, the mobile devices of key people fall within risk and incident management. Universities and research bodies, public administrations and law firms have profiles similar to those targeted in Serbia. An Apple threat notification sent to an executive should be handled as a possible incident, with a procedure ready in advance.

What to do now

1. Prepare a procedure for Apple notifications: as Security Affairs suggests, anyone who receives an Apple Threat Notification should treat the device as compromised until an expert proves otherwise. Do not restore or wipe it: the traces are needed for forensic analysis.
2. Cut the device off from the company immediately: revoke the sessions and tokens of business accounts used on that phone and change credentials from a trusted device.
3. Rely on specialist analysis: for journalists, activists and human rights defenders there is Access Now’s Digital Security Helpline; in Serbia, the SHARE Foundation. Companies should line up a mobile forensics provider in advance.
4. Enable Lockdown Mode on the iPhones of the most exposed people and keep iOS always up to date, with short deadlines enforced from the MDM console.
5. Widen the check: Security Affairs advises having the devices of close contacts and colleagues of the affected person checked too.
6. Include smartphones in the response plan: list of at-risk people, contacts for analysis, internal communication.

How ARXDOME helps

ARXDOME does not analyse smartphones: for iPhones and iPads the control point remains the MDM console. On computers and servers, the ARX Sentry identity pages show failed logons, privileged and night-time access and account changes, which help spot the use of credentials stolen from a compromised phone. ARX Horizon brings threat intelligence sources together and enriches every event with threat lists.

Last updated: 21 October 2026