Pegasus Spyware Targeting Serbian Pro Democracy Movement
Pegasus Spyware Targeting Serbian Pro Democracy Movement
Serbia’s student-led pro-democracy movement, born from the November 2024 anti-corruption protests, has faced widespread targeting with spyware as part of broader state repression. In 2026 alone, investigations led by the SHARE Foundation with the support of the Citizen Lab and Amnesty International’s Security Lab found that at least 14 people were targeted with advanced spyware. The targets included members of the protest movement, activists, and opposition party members. SHARE has noted that the timing of those cases coincided with the run-up to Serbia’s March 29, 2026 local elections. Our forensic findings from that investigation included the discovery that NSO Group’s Pegasus spyware was used to hack the phone of a student protester. Amnesty’s Security Lab found repeated use of homegrown Serbian government spyware by the authorities against protesters. This research note reveals two newly-discovered cases, raising the total to at least 16 members of civil society in Serbia publicly known to have been targeted or infected with mercenary spyware.
Professor Vladan Đokić is the Rector of the University of Belgrade and a strong supporter of Serbian students’ ongoing pro-democracy campaign. He is famous for refusing to facilitate a government-led crackdown on student protesters, which led to intense pressure from the Serbian authorities. On March 31, 2026, Serbian authorities raided his offices, and reportedly seized computers and servers. With the assistance of the SHARE Foundation, the Citizen Lab analyzed forensic artifacts collected from Vladan Đokić’s Apple iPhone. We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026. The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection.
Rade Bajić was a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime (TOK) in Belgrade. He is best known for his work on a corruption investigation into a failed “Trump Tower” project in Belgrade, Serbia. Mr. Bajić was sent an Apple Threat Notification on August 13th, 2026, as well as a reminder message on August 27th, 2026. We judge the receipt of an Apple Threat Notification to be a high confidence indicator that his device was likely targeted with mercenary spyware, such as Pegasus. Our forensic analysis of the artifacts collected from his device is ongoing.
An Apple Threat Notification is serious, and indicates that you were likely targeted by a government using mercenary spyware, such as Pegasus. If you believe that you may be targeted with mercenary spyware because of who you are or what you do, we urge you to use optional security features on your iPhone. Apple users can enable Lockdown Mode, which seriously increases the security of your device. We urge everyone, especially those facing increased risks because of who they are or the work they do, to keep all devices updated.