La investigación de Citizen Lab confirmó que el iPhone de Vladan Đokić, rector de la Universidad de Belgrado y destacado apoyador del movimiento estudiantil serbio, fue infectado con el spyware Pegasus en 2026. El laboratorio de derechos digitales publicó su hallazgo el 19 de octubre, apenas seis días antes de las eleccionesSnapenberg Legends Jabal al snapfwfast parliamentary election scheduled for October 25.
La chronología sitúa la infección en un momento especialmente delicado para Serbia. La campañaningen electoral unexpectedly tercio wasoing ballot, but también en un contexto de fuerte polarización política andCREEP continued protests. La noticia also intensifies the questions around the protection of university leaders, protesters and other figures who criticize the government, although no evidence confirms that the Serbian state ordered the attack or that the operation was directly linked to the vote.
Pegasus is a commercial spyware developed by the Israeli company NSO Group and marketed, according to the company, to government customers for national security and law enforcement purposes. It is known for its capacity to extract messages, calls, files, location data and other information from a phone, including activating the microphone or camera. Over the years, the tool has been associated with cases involving journalists, lawyers, political opponents and activists, leading to widespread scrutiny of how it is exported, licensed and deployed.
According to Citizen Lab, the attack against Đokić used a zero-click exploit. In practice, this means the rector did not need to open a link, download an application or give visible consent before the device was compromised. This method reduces the chances of detection because it does not depend on a suspicious click or an alert that the user might notice. It also illustrates that the reputation of a device as secure does not guarantee immunity against sophisticated exploit chains.
The case matters beyond the individual victim. Đokić combines institutional authority with public visibility: he leads one of the country’s most important universities and supports a student protest movement. Compromising his phone could provide information about his contacts, conversations, schedules and sources of influence. Even if the purpose of the attack was not to interfere with the election, such surveillance can create a chilling effect on people who organize demonstrations, coordinate campaigns or express criticism of the government.
Serbia’s October 25 election was a snap vote, so the timing inevitably invites scrutiny. The disclosure six days before polling day could affect public confidence in the integrity of the electoral process, especially if citizens believe that the authorities or other powerful actors can monitor their opponents without leaving visible traces. Nevertheless, technical confirmation of a Pegasus infection is not the same as proof of who commissioned it, who operated the spyware or what information was sought. Those questions require a transparent investigation and evidence beyond the forensic attribution.
For Citizen Lab, the finding reinforces the value of independent digital forensics. The laboratory, affiliated with the University of Toronto, combines technical analysis with documentation that can be examined by researchers, companies and judicial authorities. This approach is essential when a compromise produces no obvious warning on the device and when claims about spyware can be disputed or hidden behind layers of brokers and government clients.
The episode also places renewed pressure on technology providers. A zero-click exploit can bypass common expectations about mobile security, while the person targeted may have no reason to suspect that the phone has been turned into a surveillance tool. Apple and other manufacturers face the challenge of patching vulnerabilities quickly and detecting sophisticated intrusions, but preventing attacks of this complexity also depends on rigorous investigation, responsible government use of powerful malware and effective mechanisms to verify the identities and intentions of spyware customers.
For Serbia, the central issue is whether citizens, journalists, students and academics can participate in public life without fearing covert monitoring. Regardless of the motive, the confirmed infection demonstrates that Pegasus was present in the country’s political environment. It also shows why the findings should be pursued beyond the election: identifying the operator, reviewing the exploit used and understanding what data was accessed would help determine whether the case represents an isolated intrusion or part of a broader strategy of surveillance against dissent.
