Pegasus Spyware Confirmed on University Rector's iPhone Days Before Election

Introduction

The recent revelation that the iPhone belonging to Vladan Đokić, the rector of the University of Belgrade and a known supporter of Serbia's student protest movement, had been compromised by NSO Group's Pegasus spyware marks a significant development in the ongoing cybersecurity landscape. According to findings released by Citizen Lab on October 19, 2026, the infection occurred six days prior to Serbia’s snap parliamentary election scheduled for October 25. This timeline places the incident at a critical moment in the national political calendar, raising serious concerns about digital privacy and electoral security.

Pegasus spyware is widely recognized for its sophisticated capabilities, designed to collect extensive personal data from targeted individuals through covert means. Its use represents not only a violation of privacy but also a potential threat to democratic processes when deployed during periods of political instability. The case involving the university rector underscores how even prominent public figures can become targets in modern cyberattacks, especially when their activities intersect with social movements that challenge established powers.

Discovery and Confirmation

Citizen Lab, an independent research organization specializing in surveillance technology, conducted a thorough investigation that led to the confirmation of the Pegasus infection on Đokić’s device. The discovery came shortly after the election loomed large in the public consciousness, making the timing particularly noteworthy. The analysis revealed that the spyware had been implanted remotely, exploiting vulnerabilities in iOS security protocols to gain unauthorized access to the phone’s operating system.

• The infection technique employed a zero-click exploit, meaning the attacker bypassed traditional security measures by triggering malicious code execution without requiring user interaction such as tapping a link.
• This type of attack is considered highly advanced and often involves sophisticated social engineering tactics to trick the target into engaging with the malicious payload.
• Citizen Lab’s methodology included reverse engineering, network analysis, and forensic examination of the device logs to trace the origin and characteristics of the spyware.
• The report emphasizes that no direct evidence of malicious activity was observed on the device itself, suggesting the intrusion may have occurred from external command-and-control infrastructure connected to the NSO Group network.

Zero-Click Exploit Mechanics

One of the most alarming aspects of this case is the use of a zero-click exploit. Such vulnerabilities allow malware to execute without any user intervention, rendering conventional defenses ineffective. In the context of Đokić’s security breach, this meant the rector could be infected simply by being present with his iPhone—his actions were never required to initiate the compromise. This approach highlights the fragility of mobile security when devices are frequently accessed in high-risk environments, such as during political rallies or public events. Understanding zero-click attacks is crucial for developing next-generation protection strategies. These exploits typically leverage flaws in app permissions, system-level memory management, or communication channels between the device and cloud services. Countermeasures include rigorous software auditing, mandatory updates, and enhanced detection mechanisms that monitor anomalous behavior patterns indicative of remote compromise.

Political and Security Implications

The occurrence of such an infection just days before a national election carries profound implications for both cybersecurity and governance. When high-profile individuals are targeted, it can influence public perception, media narratives, and potentially voter behavior. In Serbia, where student protests have played a role in shaping recent political discourse, the targeting of a university rector who actively supports these movements adds another layer of complexity to the situation.

From a strategic standpoint, the use of Pegasus spyware by state-sponsored actors like NSO Group demonstrates a clear intent to surveil potential opponents and opposition leaders. This raises questions about the transparency of such technologies and the accountability of organizations responsible for their deployment. Citizenship rights group Citizen Lab has long advocated for stricter regulations on surveillance tools, calling for legal frameworks that limit their use against political dissidents and elected officials.

Conclusion

In summary, the confirmation that the iPhone of the University of Belgrade rector, Vladan Đokić, contained Pegasus spyware just six days before Serbia’s snap parliamentary election is a stark reminder of the persistent risks posed by advanced surveillance technologies. The use of a zero-click exploit further complicates defense efforts, as it operates outside the traditional boundaries of user interaction and device control. This incident not only damages individual privacy but also threatens the integrity of democratic processes by enabling potentially undetectable background gathering of sensitive information.

As organizations like Grivyonx Cloud continue to innovate in AI-driven security solutions and automation, it becomes ever more vital to stay ahead of emerging threats. By integrating cutting-edge threat detection capabilities and fostering transparent, accountable practices in cybersecurity, we can better protect leaders, citizens, and institutions alike from the escalating dangers of digital warfare.