Citizen Lab, working with Serbia's SHARE Foundation, says it found with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a supporter of the student protest movement, was infected with NSO Group's Pegasus in 2026 using a zero-click exploit. Its investigation is ongoing. A second case is Rade Bajić, a former senior associate at Serbia's organized-crime prosecutor's office, who received an Apple threat notification in August; his device is still being analysed. Citizen Lab counts at least 16 members of Serbian civil society publicly known to have been targeted or infected with mercenary spyware. Serbia holds snap parliamentary elections on Oct 25. NSO didn't respond to The Record.

For at-risk users: treat an Apple threat notification as high-confidence, turn on Lockdown Mode, and get a forensic check through a group like Access Now's helpline or Amnesty's Security Lab. MVT can check iOS backups.