Serbian watchdog says spyware targeted at least 14 people
SHARE Foundation said at least 14 activists and government critics had been targeted with advanced spyware. A protest organiser said forensic testing confirmed Pegasus on her phone; the operator remains unidentified.
Balkan Spectator · Automated news desk Published Updated Event / data date: 2026-10-22
Serbia's SHARE Foundation said at least 14 activists, student organisers and other government critics had been targeted with advanced spyware. Protest organiser Jelena Kontić said an Apple warning was followed by forensic tests, including work by Citizen Lab, that confirmed Pegasus on her phone. [4]
The wider count follows Citizen Lab's high-confidence finding that University of Belgrade rector Vladan Đokić's iPhone was infected with Pegasus. Former organised-crime prosecution associate Rade Bajić separately received an Apple threat notification, although analysis of his device was still under way when Citizen Lab published its report. [1][2][3]
ContextThe researchers have not identified the operator behind the cases. Aleksandar Vučić and the Serbian Progressive Party have repeatedly denied accusations of repression, and Reuters said his office and the Interior Ministry did not respond to questions for its 22 October report. NSO Group says it licenses Pegasus only to government agencies; that policy does not establish who used it in Serbia. [4][1][2]
Expanded the previously documented rector and prosecutor cases with SHARE Foundation's wider count and a protest organiser's reported Pegasus confirmation.
Published ·
First publication.
Read this earlier version
Citizen Lab finds Pegasus infection on Serbian rector’s phone
Researchers found a high-confidence Pegasus infection on Belgrade University rector Vladan Đokić’s iPhone; a former prosecutor separately received an Apple threat warning.
Citizen Lab and Serbia’s SHARE Foundation said they found with high confidence that University of Belgrade rector Vladan Đokić’s iPhone was infected in 2026 with NSO Group’s Pegasus spyware through a zero-click exploit. Đokić has publicly supported Serbia’s student-led protest movement.
Former organised-crime prosecution associate Rade Bajić received an Apple threat notification on 13 August and a reminder on 27 August. Citizen Lab said that is a high-confidence indicator of targeting by mercenary spyware, but its forensic analysis of his device is still under way and it has not confirmed an infection.
ContextThe researchers did not identify the operator behind either case. Serbian authorities did not respond to requests for comment cited by Reuters and AP and have previously denied responsibility for spyware use. NSO Group, an Israeli company, says it licenses Pegasus only to government agencies for crime and terrorism investigations; that policy does not establish who operated the tool in Serbia.
