As reported by SecurityAffairs, Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware via a zero-click exploit in 2026 — just six days before Serbia's snap parliamentary elections. This is not an isolated incident. It is part of a documented pattern of commercial spyware being deployed against civil society figures in contexts where democratic accountability is already under strain.

Threat Intelligence: As reported by SecurityAffairs, Citizen Lab has confirmed with high confidence that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware via a zero-click exploit in 2026 — just six days before Serbia's snap parliamentary elections.

The technical detail that matters most here is the delivery method: zero-click. Đokić did not click a link, open a file, or interact with any payload. The exploit required no user action whatsoever, meaning traditional mobile security awareness training — already a weak control against spearphishing — is entirely insufficient against this class of threat. This is the defining characteristic of Pegasus and similar mercenary surveillance platforms: they bypass the human layer entirely.

Why This Matters Beyond Serbia

The Đokić case fits a broader template that Shield53 has been tracking across multiple jurisdictions. When spyware deployments cluster around election cycles, anti-corruption investigations, and student or pro-democracy movements, the threat actor's intent is not espionage in the traditional intelligence sense — it is political interference and intimidation. The operational goal is situational awareness of an opponent's strategy, internal communications, and coalition-building activities at critical moments.

Citizen Lab's note that this raises the known civil society target count to 16 is significant. That number likely represents only confirmed cases — the actual deployment footprint is almost certainly larger given the forensic difficulty of detecting zero-click iOS implants and the low rate of device analysis among potential victims.

The intersection of zero-click exploit capability, mercenary vendor availability, and weak international export controls creates a surveillance environment where any government with sufficient budget can purchase nation-state-grade access to a target's most intimate communications.

The Institutional Targeting Pattern

What defenders should note is the type of target. A university rector is not a traditional intelligence target. Đokić was targeted because he became a political figure — someone who refused to facilitate a government crackdown on protesters and was publicly considered as a candidate for the Student List. The parallel Apple Threat Notification received by Rade Bajić, a senior prosecutor investigating official corruption, reinforces that the targeting logic follows political threat to power, not traditional espionage value.

For organizations that support activists, journalists, legal professionals, academics, and opposition figures operating in politically contested environments, this case is a concrete reminder that mobile device security cannot be treated as a secondary concern.

What You Should Do

For High-Risk Individuals and Organizations

The Institutional Targeting Pattern
Adopt Lockdown Mode on iOS — Apple's Lockdown Mode (available since iOS 16) disables several attack surfaces that zero-click exploits have historically leveraged, including iMessage parsing of unsolicited attachments and wired device connections. While not a guarantee, it materially raises the cost of exploitation.
Engage in regular forensic device audits — Organizations supporting high-risk users should establish relationships with forensic analysis partners (Citizen Lab, Amnesty Tech's Security Lab, Access Now's Digital Security Helpline) before an incident occurs.
Separate communications infrastructure — Use dedicated, disposable devices for sensitive communications. Assume that any primary device with a rich app ecosystem and message history is a viable target.
Monitor Apple Threat Notifications — Take state-sponsored attack warnings seriously. Bajić's notification appears to have been a valid indicator in this case.

For Security Teams Supporting At-Risk Populations

  • Threat model for zero-click — Accept that phishing-resistant MFA, security awareness training, and link-scanning do not protect against zero-click mobile exploits. Build controls that assume device compromise is possible.
  • Implement end-to-end encrypted comms with metadata minimization — Even with device compromise, reducing the volume and sensitivity of data stored on-device limits the intelligence value of a successful implant.
  • Track the regulatory landscape — The EU's pending legislation on spyware and the ongoing U.S. executive actions against commercial surveillance vendors are shaping the market. CISOs in regulated industries should monitor how these developments affect vendor risk assessments.

The commercial spyware industry has matured into a tool of political power projection. Defenders must respond not by pretending awareness training will close the gap, but by building security architectures that assume the endpoint is compromised and still preserve the confidentiality of what matters most.