Belgrade University Compromised: Pegasus Spyware Hits Rector Days Before Snap Election

How did the infection occur?

The Citizen Lab confirmed on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade, contained NSO Group’s Pegasus spyware. The research group identified the infection with high confidence based on forensic artifacts collected from the device at Đokić’s request. The malware leveraged a zero-click exploit, which means the software executed without Đokić tapping a link or opening a file. This method allows attackers to compromise devices silently, bypassing standard user interaction safeguards.

What does the spyware enable?

Once installed, Pegasus grants operators the same level of access to the device as its owner. According to the Citizen Lab, this includes the ability to access private and encrypted messages. The spyware can also activate the microphone and camera without the user’s knowledge. This level of access allows adversaries to monitor communications and surroundings in real time. The capability represents a significant breach of privacy and security for high-profile targets who rely on encrypted channels for sensitive discussions.

Who else was targeted?

The report also highlights the case of Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime. Bajić received an Apple Threat Notification on August 13, followed by a reminder on August 27. Apple issues these alerts when it detects activity consistent with mercenary spyware attacks. The Citizen Lab treats such notifications as a high-confidence indicator that a device was targeted. Forensic analysis of Bajić’s device is ongoing, and it remains unconfirmed whether the phone was fully infected.

Why is the timing significant?

The confirmation of Đokić’s infection came six days before Serbia’s snap parliamentary election on October 25. Đokić is a prominent supporter of the student protest movement and had been named as a possible candidate to lead the Student List. Serbian authorities raided his offices on March 31, seizing computers and servers. The proximity of the spyware discovery to the election raises concerns about digital intimidation tactics. Đokić described the incident as another attempt at intimidation and called for an independent investigation.

What analysts watch for

Teams usually examine network logs for unusual outbound traffic to known command-and-control servers associated with commercial spyware vendors. They also review device integrity reports and look for signs of kernel-level modifications or unauthorized access to system resources. Analysts check whether the device has received vendor-specific threat notifications, which often indicate targeted exploitation attempts. Persistence mechanisms typically involve deep system integration, making detection difficult without specialized forensic tools or vendor cooperation.

What to do and how to stay safe: Pegasus

• Monitor device logs for unexpected network connections, especially to unfamiliar or suspicious IP addresses.
• Check for vendor-issued threat notifications or alerts indicating potential spyware activity.
• Limit exposure by keeping operating systems and applications updated to the latest versions.
• Consider using hardware-based security features that can detect unauthorized access attempts.

Step-by-step guide: Ransomware Incident Response: 6 Common Misreadings Corrected

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Vladan Đokić have to click anything to get infected?

No, the infection used a zero-click exploit, meaning no user interaction was required.

Is it confirmed that Rade Bajić’s phone was infected?

No, forensic analysis is ongoing, but Apple issued threat notifications to his device.

Who conducted the investigation into the spyware infection?

The Citizen Lab, in collaboration with the SHARE Foundation, analyzed the forensic data.