Pegasus Spyware Found on Belgrade University Rector's iPhone Six Days Before Serbian Election

Key points

• Citizen Lab said on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a visible backer of Serbia's student protests, was infected with Pegasus spyware made by Israeli firm NSO Group.
• The infection was discovered six days before Serbia's October 25 snap parliamentary election.
• Attackers used a zero-click exploit, meaning the rector didn't have to tap anything for his phone to be taken over.
• Apple's own threat-notification system, which alerts people it believes are being hunted by state-grade spyware, flagged the device.
• Apple's Lockdown Mode, a stripped-down setting built to blunt these attacks, exists for people in exactly Đokić's position.

Vladan Đokić, head of the University of Belgrade, had Pegasus installed on his iPhone without touching a thing. The University of Toronto's Citizen Lab announced the finding on October 19, six days before Serbia's October 25 snap parliamentary election. We covered a similar zero-click hit on a Serbian student activist on 3 September; this time the target is the rector of the country's largest university, in the final week of a national campaign.

Đokić has become the public face of the student-led protest movement that has rattled the Serbian government for most of the year. The timing matters.

What is Pegasus, in plain terms?

Pegasus is spyware, a program that quietly turns a phone into a surveillance device. Once installed, it can read messages, track location, and capture almost anything else on the handset. NSO Group sells it only to governments, which have repeatedly been caught deploying it against journalists, lawyers and opposition politicians.

This attack was zero-click: no dodgy link, no attachment, no mistake by the victim. The phone was compromised by a method the owner never saw.

How was the infection spotted?

Apple spotted it first. The company runs a notification programme that pings users when its systems believe a nation-state-grade operator is targeting them personally. Apple's own description is blunt: these attacks "cost millions of dollars", are aimed at a tiny number of people, and are historically associated with state actors, with NSO's Pegasus named directly.

Đokić received one of those alerts. Citizen Lab then examined the device and confirmed Pegasus. That's the standard chain of custody for these cases, and it's how most Pegasus infections of European civil society have surfaced in recent years.

Is this the first time Serbia has come up?

No. Serbian authorities have been named in previous Citizen Lab and Amnesty International reports involving Pegasus and a separate Android spyware called NoviSpy, with victims including activists and journalists. What's new here is the target: the sitting rector of the country's largest university, infected during an election campaign.

Serbia's government has previously denied operating Pegasus.

Should you worry about your own phone?

Almost certainly not, and that's the honest answer. Pegasus isn't used on regular people. It's expensive, it burns rare software flaws when deployed, and operators guard it carefully.

If you're a journalist, lawyer or human-rights worker, the calculation shifts. Lockdown Mode, available on iPhones running a recent version of iOS, deliberately restricts features that spyware tends to abuse: message attachments are stripped back, certain web technologies are blocked, and incoming invitations from strangers are refused. It makes the phone less comfortable to use and meaningfully harder to infect.

The judgement

Six days out from a snap election, the phone of the most prominent academic backing the protest movement lights up with Pegasus. Treat the timing as the story. The technical playbook is familiar by now: NSO sells, a government buys, a critic gets owned, Citizen Lab publishes. What to watch is whether any European regulator does more than issue a statement this time.