Pegasus Spyware Targets Serbian Activists and Prosecutors Ahead of Elections

Researchers at the University of Toronto's Citizen Lab confirmed that University of Belgrade Rector Vladan Đokić's phone was infected with Pegasus spyware in 2026 via a zero-click exploit, while prosecutor Rade Bajić received an Apple warning of mercenary spyware targeting; these cases were revealed six days before Serbia's October 25 parliamentary election, with Đokić backing student-led anti-corruption protests and Bajić involved in a corruption investigation linked to Jared Kushner's investment firm, amid reports from SHARE Foundation and Citizen Lab that at least 15 people were targeted with advanced spyware in Serbia during 2026, following a police raid on Đokić's offices and Bajić's removal from the Kushner-related case in 2025.

The 2026 Serbian Election Was Never Going to Be Decided at the Ballot Box

Count the dates. In August, an Apple warning lands on the phone of a Serbian prosecutor—Rade Bajić—who had been removed from a corruption case involving a Belgrade development linked to Jared Kushner's investment firm. No tool identified, "investigation continues." Then, six days before the Oct. 25 parliamentary election, a university rector who backs anti-corruption protests is confirmed to have been silently infected with Pegasus through a zero-click exploit—a hack that requires no mistake, no click, no human error. You are not supposed to notice that these two things happened in the same year, in the same country, against people who stood in the way of the same redevelopment deal. You are supposed to believe in isolated incidents and incompetent investigators. But look at the pattern: at least 15 people targeted in 2026, after an earlier wave of 14. That is not noise. That is a cleanup operation.

Kushner, the Cultural Heritage Raid, and the Architecture of Consent

Why would a prosecutor be quietly transferred off the Kushner-related case in November 2025—one full year before the election—and then suddenly receive a spyware warning? Why would police raid the rector's offices in March and seize computers and servers, only for Citizen Lab to confirm Pegasus months later? Connect the dots: Serbia's culture minister was charged for stripping the Belgrade site's cultural-heritage status—the legal prerequisite for turning that land into a Kushner project. That's not a local scandal. That's a template. First you remove the legal protections, then you remove the people who object. The phone infections are the enforcement arm of an invisible government. The real estate deal is the reward. The election is the theater. They don't care whether you vote; they care that you cannot see who is actually pulling the strings. And when a prosecutor like Bajić speaks out against political repression in February—before the warnings, before the raids—they don't answer him with debate. They answer with a silent, surgical intrusion into his personal device. That is the tell.

The Breadcrumb They Hope You Never Follow

Ask yourself this: who sells Pegasus? Who has the legal cover to authorize its use against a university rector and a corruption prosecutor—both obstacles to a foreign investment linked to a son-in-law of a former U.S. president? The same networks that fund the foundations, the same dynasties that appear on every board of every NGO, the same intelligence agencies that deny everything. You will be told these are "unrelated cases." You will be told the investigation is "ongoing." But notice how every single time someone gets close to the money, the story frays, the official denies, and the malware disappears. Why did that August warning come before the tool was identified? Why was the prosecutor transferred without explanation? Why did the raid happen in March, and the confirmation drop in October—just days before the vote? The answer is already on the public record. You just have to stop taking their timeline as gospel. Follow the property. Follow the legal reclassification. Follow the intercepted phones. The architecture is there. The question is whether you're ready to look at it without flinching.

AdFection: Malicious Ads as a Zero-Click Spyware Vector

Germany’s domestic intelligence agency has warned that malicious online ads pose a significant espionage threat, citing AdFection, a zero-click spyware method where an ad can trigger an attack without user interaction. Research from Citizen Lab linked the technique to Israeli advertising firm Discover-Tech and spyware maker Candiru (now Integrity Labs), finding at least 45 devices at Al Jazeera were infected in 2024–2025 and that ad-delivery systems targeted selected devices with attack code while showing ordinary ads to others. Ads also appeared on devices connected to government, defense, and international organizations, though researchers note an ad appearing on a network does not prove compromise. Citizen Lab also identified a separate actor, Dark Cartographer, using Discover-Tech infrastructure to exploit mobile-carrier vulnerabilities and link advertising IDs to phone numbers. Discover-Tech ads were found in apps including Wetter Online, Viber, Grindr, and Badoo, and security scanners may have missed the attacks because they only verified benign ads shown to ordinary viewers.

You want to know why Germany’s intelligence service is suddenly admitting that “malicious online ads” can be a zero-click espionage tool? Because they were caught. For years the same people who run the global “ad tech” industry have been building the perfect weapon: an advertising network that can deliver benign banners to auditors, while simultaneously injecting attack code into the phones of specific human targets. The article hands you the trail — an Israeli advertising firm called Discover-Tech, a spyware shop called Candiru that conveniently “rebranded” to Integrity Labs, and a university lab that found 45 Al Jazeera devices infected in 2024 and 2025. Do you really believe a university research group stumbled onto an Israeli ad company that just happens to be selling access to mobile carriers? That’s not discovery. That’s a breadcrumb. The German warning is not a warning to the public — it’s a notice to the spymasters that one layer of the architecture has been exposed, and now they have to build a new one.

Now connect the dots the way they don’t want you to. AdFection isn’t a hack. It’s the logical endpoint of a system that has been monitoring every scroll, every tap, every location ping for decades. The article admits the ads “selected devices and sent attack code to them” while everyone else saw normal content — so the same infrastructure that delivers you a weather forecast or a dating app is the infrastructure that silences a journalist in Doha or maps a Saudi diplomat’s every movement. And what does the article say about Dark Cartographer? A separate actor using Discover-Tech’s infrastructure to exploit mobile-carrier vulnerabilities and link advertising IDs to phone numbers. That’s not espionage. That’s total identification. Every phone number, every device, every individual, filed into a database owned by private companies that contract with intelligence agencies. The Citizen Lab “caution” — that an ad appearing on a network doesn’t prove compromise — is the standard cover phrase. Of course they caution. The scanner networks were shown benign banners. The only people getting the attack code were the people who could not be allowed to speak. Ask yourself why Wetter Online quietly removed Discover-Tech as a data-sharing partner in February 2025. Ask yourself who ordered that. Then ask yourself what else they removed.

This is the architecture. Not a lone hacker, not a rogue actor, but a permanent surveillance estate that fuses advertising, telecommunications, and state power into one invisible machine. They infected Al Jazeera — a news network that inconveniently reports from places they don’t want covered. They targeted Saudi Arabia’s Foreign Ministry — because diplomacy is war by other means, and every ministry is a target. They are not attacking your phone because you matter to them. They are attacking your phone because the system is already built, and you are the reason it remains funded. The moral trick is to make you believe this is about “cybercrime.” It is not. It is about who gets to see, who gets to speak, and who gets to exist without being catalogued. You have more allies than you know — the researchers, the whistleblowers, the people inside the telecoms who leak the data-sharing partner lists. But they cannot move until you ask the question they are all afraid of: if an ordinary ad system can be weaponized this easily, for this long, with virtually no accountability, then what exactly has been running on the devices in your own home? Do not expect the answer from the same agencies that are “warning” you. Look at the data-sharing agreements no one reads. Follow the money. And ask why every disclosure arrives just late enough for the architects to already be using something better.