As reported by The Hacker News, the Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware via a zero-click exploit. The confirmation came six days before Serbia's October 25 snap parliamentary election, raising urgent questions about the intersection of commercial spyware and democratic integrity.

Threat Intelligence: As reported by The Hacker News, the Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware via a zero-click exploit.

Strategic Significance: Spyware as Electoral Infrastructure

What makes this case particularly consequential is not merely the technical confirmation of Pegasus — which has been documented in dozens of countries — but the timing and targeting pattern. Đokić is an academic leader aligned with a protest movement that emerged from the November 2024 Novi Sad railway station canopy collapse that killed 16 people. The snap election itself was called in September 2026 after nearly two years of protests. Deploying full-device surveillance against a movement figurehead in the final week of a campaign suggests an intent to gather strategic intelligence on opposition organizing, donor networks, or protest contingency plans at a critical inflection point.

The second case involving Rade Bajić — a senior prosecutorial associate who received Apple Threat Notifications on August 13 and August 27 — adds a further dimension. Bajić worked on the Generalštab corruption investigation, which concerns the removal of heritage protection from a bombed-out military complex to enable a luxury development linked to Jared Kushner. Bajić claims he was removed from the investigation in November 2025 without explanation. The targeting of both a protest-aligned academic and a corruption prosecutor indicates a horizontal surveillance campaign touching multiple pillars of democratic oversight simultaneously.

The Zero-Click Problem for Defenders

The Citizen Lab confirmed that Đokić's infection used a zero-click exploit, meaning no user interaction — no tap, no link, no file — was required. This is the most concerning class of mobile exploit because traditional endpoint detection signals (spearphishing, malicious attachments, suspicious SMS) are entirely absent. For security teams protecting high-risk individuals, this means:

The Zero-Click Problem for Defenders
User awareness training has near-zero preventive value against this specific threat. Phishing simulations and link-checking protocols would not have prevented this infection.
Network-level detection is insufficient. Pegasus zero-click chains have historically used iMessage (FORCEDENTRY, CVE-2021-30860) and other vectors that may not traverse corporate or carrier network monitoring.
Apple Threat Notifications are a trailing indicator. Bajić received notifications, but these alerts arrive after targeting is detected and provide no real-time defensive capability.

Why Lockdown Mode Matters Now

Apple's Lockdown Mode — introduced in iOS 16 and expanded in subsequent releases — is the single most effective user-configurable mitigation against mercenary spyware. It disables or restricts message attachments, web content rendering, and unsolicited invitation processing — the exact attack surfaces zero-click Pegasus chains have historically exploited. The trade-off is usability degradation, which makes it impractical for all users but essential for those in elevated risk categories.

Shield53 Recommendations

For organizations and individuals operating in environments where mercenary spyware deployment is plausible — political campaigns, investigative journalism, anti-corruption bodies, civil society organizations, and academic institutions in politically volatile regions:
  • Enable Apple Lockdown Mode immediately on devices belonging to principals, senior staff, and anyone with access to sensitive communications. This is non-negotiable for high-risk users.
  • Conduct forensic device analysis using tools like MVT (Mobile Verification Toolkit) maintained by Amnesty International, particularly for any staff who have received Apple Threat Notifications or who may be unaware they were targeted.
  • Implement compartmentalized communications: Use dedicated, non-personal devices for sensitive discussions. Assume that any compromised device exposes its full messaging history, contacts, and real-time audio/video.
  • Establish a mobile device incident response plan that includes forensic preservation, chain-of-custody documentation, and coordination with organizations like the Citizen Lab or Amnesty Tech before wiping or replacing devices.
  • Brief principals on the threat model: Ensure that political figures, prosecutors, and protest leaders understand that their personal devices are likely targets, not merely their institutional or work-issued equipment.
  • For security teams in at-risk organizations: inventory all iOS devices used by principals and their immediate staff, verify iOS is updated to the latest available version, and schedule periodic forensic checks using MVT or equivalent tools.

The Serbian cases underscore that mercenary spyware is not a hypothetical threat — it is an active, deployed capability being used against the structural foundations of democratic governance. The absence of confirmed attribution in the Đokić case should not be interpreted as uncertainty about the threat; it should be interpreted as a reminder that the commercial spyware industry operates with opacity that benefits its government clients above all.