Researchers say the phone of Belgrade University rector Vladan Đokić was infected with Pegasus spyware. Published six days before Serbia’s parliamentary election, the findings put the security of public figures and independent institutions under renewed scrutiny.
Serbia’s election campaign faces fresh questions about digital surveillance after Citizen Lab and the SHARE Foundation reported that Vladan Đokić, rector of the University of Belgrade and a prominent supporter of the student protest movement, had his phone compromised with Pegasus spyware.
In findings published on October 19, Citizen Lab said its forensic investigation established the infection with a high degree of confidence. The researchers said the attack occurred during 2026, with their investigations continuing. Citizen Lab
The disclosure comes ahead of the October 25 parliamentary election, in which the student-backed electoral movement is challenging the Serbian Progressive Party associated with Aleksandar Vučić. Associated Press
What the investigation found
According to SHARE, forensic analysis confirmed that Đokić’s phone was infected using a zero-click attack involving Pegasus, the surveillance software developed by Israel’s NSO Group. A zero-click attack does not require the target to open a malicious link or attachment.
SHARE identified Đokić’s support for student protests and defence of university autonomy as important context surrounding the case. Those political circumstances, however, should be distinguished from technical evidence establishing responsibility for the intrusion. SHARE Foundation
A second case requires a different description
The researchers also reported that Rade Bajić, a senior prosecutorial associate who worked on the General Staff redevelopment investigation, received an Apple threat notification in August.
Citizen Lab describes such notifications as high-confidence indicators of targeting with mercenary spyware. It did not present Bajić’s case as a confirmed Pegasus infection in its published summary. Citizen Lab
The distinction matters: an alert about targeting, a successful device compromise and identification of the software involved are separate findings. Reporting them as equivalent would overstate what has been established.
Why this matters for the election
The electoral significance extends beyond whether the disclosure changes voting intentions.
From an election-analysis perspective, the security of private communications can affect how public figures, institutions and political movements operate. Concern about surveillance may discourage sensitive conversations, complicate coordination or make potential sources reluctant to share information.
Those are risks arising from the findings, rather than demonstrated consequences in these particular cases. Establishing what information was accessed, how it was used and whether it affected political activity would require further evidence.
The timing also needs care. October 19 is the publication date of the findings; it should not be presented as the date on which the confirmed infection occurred.
What remains unresolved
The next questions concern the scope of the intrusions, responsibility for them and the response of the institutions involved. Further technical findings may clarify the distinction between suspected targeting and confirmed compromise.
For readers following Serbia’s election, the report belongs alongside scrutiny of campaign conditions and institutional independence. It provides no basis on its own to predict the winner, quantify a change in support or claim that votes have been manipulated.
Its immediate importance is more specific: researchers have documented a serious intrusion affecting a prominent university figure during an election year, while a second reported case remains under investigation. Citizen Lab
