The confirmed and suspected targets include a university rector backing Serbia's protests and a prosecutor who investigated a Trump-linked Belgrade development, weeks before parliamentary elections.
The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared first on CyberScoop.
Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.
Vladan Ðokić, the rector of the University of Belgrade and prominent figure in the country’s student protest moment, and Rade Bajić, a lawyer with Serbia’s Public Prosecutor’s Office for Organized Crime, were targeted, according to research from the SHARE Foundation, a Serbian digital rights group, and The Citizen Lab at the University of Toronto.
The new cases follow what the SHARE Foundation described in September as the largest documented wave of spyware surveillance in the country to date. That wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.
Đokić, an architect and former dean of the university’s Faculty of Architecture, has led the University of Belgrade since 2021. He has publicly backed the student-led anti-corruption protests that followed the 2024 Novi Sad railway station canopy collapse, and government officials and pro-government news outlets have portrayed him as a driving force behind the movement.
His tenure has included direct confrontations with the government. In March, Serbian authorities raided his offices, and reportedly seized computers and servers. After the incident, Đokić accused authorities of trying to humiliate the institution, saying police entered without prior notice or clear legal grounds.
Andrijana Ristić, a researcher at the SHARE Foundation, whose organization conducted the initial forensic analysis, said the case is the second confirmed Pegasus infection in Serbia this year. She declined to say when the infection was discovered, citing the sensitive nature of the investigation.
The device was then given to The Citizen Lab to further confirm that Pegasus was used.
“We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026,” a report released by the lab reads. “The infection leveraged a zero-click exploit. No action, such as a click or opening a file was necessary for infection.”
Ðokić was unavailable for comment.
Bajić was on the legal team prosecuting a high-profile corruption case involving Serbian government officials signing off on a $500 million hotel and residential tower planned for a protected historic site in Belgrade. According to recent reporting from The Guardian, Serbian President Aleksandar Vučić allegedly pressed government officials to strip the building’s protection so that Affinity Partners, the private investment firm owned by Jared Kushner, could develop it into a Trump hotel.
Bajić believes his work on the case led to him being a target of spyware. He pointed CyberScoop to news articles and Serbian television programs where Vučić referred to him as a “criminal” and part of a “gang that fabricated” the corruption case.
“In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,” Bajić told CyberScoop.
Ristić told CyberScoop that Bajić received a threat notification from Apple, but neither SHARE nor Citizen Lab could pinpoint exactly what type of spyware his device was infected with. The investigation of Bajić’s device is ongoing.
Ristić described surveillance in Serbia as longstanding, tracing it to earlier tools such as FinFisher and alleged dealings with the hacking group Hacking Team — along with the original NoviSpy report by Amnesty International in 2024, which identified journalists, activists and civil society members as targets.
“I would definitely say that [spyware] is widespread,” she told CyberScoop. “I think right now it’s gaining much more media attention, especially internationally, because of the political moment.”
John Scott-Railton, senior researcher at The Citizen Lab, said “NSO has spent a decade claiming to turn over a new leaf each time an abuse surfaces. But there is no hiding the truth: Pegasus is a technology for repression. So it’s no accident that people standing up for freedom in the face of corruption keep getting hacked with NSO’s products.”
Serbia will hold parliamentary elections Oct. 25, with Vučić fighting to retain control of the government. The vote comes amid the student-led protest movement, fueled by anger over government corruption, that has grown into the largest challenge to Vučić’s rule in years.
The post Spyware found on devices belonging to prominent Serbian critics as elections loom appeared first on CyberScoop.
Source: CyberScoop
Source Link: https://cyberscoop.com/pegasus-spyware-serbia-critics-elections/