The Citizen Lab, a University of Toronto research group, said it found Pegasus spyware, made by NSO Group, on the iPhone of Vladan Đokić, rector of the University of Belgrade. Working with Serbia's SHARE Foundation, it studied records taken from the phone and is highly confident of a 2026 infection. It also said Rade Bajić, who worked at Serbia's organized crime prosecutor's office, got Apple threat notifications on August 13 and 27. At least 16 Serbian civil society members are now publicly known as targets or infected.
The proof differs. For Đokić, the lab examined data collected from the phone itself. The attack was zero-click: no tap or opened file was needed. For Bajić, the lab says Apple's notice is a high-confidence sign his phone was likely targeted. That is not proof of infection. CyberScoop reported that neither the lab nor SHARE can say which spyware he faced. Work on both phones continues. The sources do not say who carried out the attacks.
Our argument: a warning is a reason to act, not a verdict. The lab urges recipients to seek expert help, have close contacts screened, and keep devices updated. It also urges people at risk to use Lockdown Mode. Organisations with staff in high-risk roles could plan for those steps before an alert arrives.