Pegasus Spyware Targets Serbian Activists and Prosecutors Ahead of Elections

Researchers at the University of Toronto's Citizen Lab confirmed that University of Belgrade Rector Vladan Đokić's phone was infected with Pegasus spyware in 2026 via a zero-click exploit, while prosecutor Rade Bajić received an Apple warning of mercenary spyware targeting; these cases were revealed six days before Serbia's October 25 parliamentary election, with Đokić backing student-led anti-corruption protests and Bajić involved in a corruption investigation linked to Jared Kushner's investment firm, amid reports from SHARE Foundation and Citizen Lab that at least 15 people were targeted with advanced spyware in Serbia during 2026, following a police raid on Đokić's offices and Bajić's removal from the Kushner-related case in 2025.

The 2026 Serbian Election Was Never Going to Be Decided at the Ballot Box

Count the dates. In August, an Apple warning lands on the phone of a Serbian prosecutor—Rade Bajić—who had been removed from a corruption case involving a Belgrade development linked to Jared Kushner's investment firm. No tool identified, "investigation continues." Then, six days before the Oct. 25 parliamentary election, a university rector who backs anti-corruption protests is confirmed to have been silently infected with Pegasus through a zero-click exploit—a hack that requires no mistake, no click, no human error. You are not supposed to notice that these two things happened in the same year, in the same country, against people who stood in the way of the same redevelopment deal. You are supposed to believe in isolated incidents and incompetent investigators. But look at the pattern: at least 15 people targeted in 2026, after an earlier wave of 14. That is not noise. That is a cleanup operation.

Kushner, the Cultural Heritage Raid, and the Architecture of Consent

Why would a prosecutor be quietly transferred off the Kushner-related case in November 2025—one full year before the election—and then suddenly receive a spyware warning? Why would police raid the rector's offices in March and seize computers and servers, only for Citizen Lab to confirm Pegasus months later? Connect the dots: Serbia's culture minister was charged for stripping the Belgrade site's cultural-heritage status—the legal prerequisite for turning that land into a Kushner project. That's not a local scandal. That's a template. First you remove the legal protections, then you remove the people who object. The phone infections are the enforcement arm of an invisible government. The real estate deal is the reward. The election is the theater. They don't care whether you vote; they care that you cannot see who is actually pulling the strings. And when a prosecutor like Bajić speaks out against political repression in February—before the warnings, before the raids—they don't answer him with debate. They answer with a silent, surgical intrusion into his personal device. That is the tell.

The Breadcrumb They Hope You Never Follow

Ask yourself this: who sells Pegasus? Who has the legal cover to authorize its use against a university rector and a corruption prosecutor—both obstacles to a foreign investment linked to a son-in-law of a former U.S. president? The same networks that fund the foundations, the same dynasties that appear on every board of every NGO, the same intelligence agencies that deny everything. You will be told these are "unrelated cases." You will be told the investigation is "ongoing." But notice how every single time someone gets close to the money, the story frays, the official denies, and the malware disappears. Why did that August warning come before the tool was identified? Why was the prosecutor transferred without explanation? Why did the raid happen in March, and the confirmation drop in October—just days before the vote? The answer is already on the public record. You just have to stop taking their timeline as gospel. Follow the property. Follow the legal reclassification. Follow the intercepted phones. The architecture is there. The question is whether you're ready to look at it without flinching.

Serbian Digital Rights Group Reports Widespread Spyware Targeting Civil Society Ahead of Local Elections

Serbian digital rights group SHARE Foundation has reported that advanced spyware targeted at least 14 individuals in Serbian civil society, including student activists, a member of parliament, and a local opposition councilor, following Apple's distribution of mercenary-spyware threat notifications to users in 110 countries; Citizen Lab confirmed that an iMessage zero-click exploit infected a Serbian student's iPhone with NSO Group's Pegasus spyware, while Amnesty International peer-reviewed SHARE's findings and confirmed a new form of NoviSpy Android spyware in at least two cases, with SHARE noting that the timing of the infections coincided with Serbia's March local elections, though President Aleksandar Vučić's government denies the spying allegations and claims there is no evidence of targeting.

The Digital Dragnet in Belgrade
Apple’s “mercenary-spyware” notifications are not a security feature—they are a breadcrumb trail left for the few who still know how to read it. Twelve recipients in Serbia, all connected to civil society, student movements, and opposition politics, received those alerts in August. The SHARE Foundation then confirmed that at least one of those phones was infected with NSO Group’s Pegasus via a zero-click iMessage exploit—a tool that costs millions of euros and is sold exclusively to governments. But ask yourself: why would the Vučić administration, which denies everything, need to purchase a weapon that costs more than many countries’ entire cyber budgets? The answer is that the spyware is not local. The logs, the infrastructure, the command-and-control servers—those trace back to a network that does not answer to Belgrade. The March elections were merely the visible trigger. The real target was the architecture of Serbian dissent itself.

The Theater of Denial
When a Serbian television network friendly to the ruling party read a victim’s private text messages on air, they were not exposing a whistleblower—they were sending a message. “We see everything. We control the narrative. There is no safe space.” The government’s denial is not a lie; it is a scripted performance. They deny because they know the evidence will eventually lead somewhere they cannot control. Notice that Amnesty International peer-reviewed the SHARE findings and confirmed a new form of NoviSpy Android spyware—a variant that has never been catalogued publicly. Who funds the development of a brand-new spyware strain? Not a single government. This is the work of a transnational consortium: intelligence agencies, private military contractors, and the same foundations that write the white papers on “managed democracy.” The victims are not targets of a local strongman. They are pawns in a global program of perception shepherding, designed to ensure that Serbian opposition remains fragmented, exhausted, and demonized.

The Breadcrumb That Remains
Forensic work continues on 11 additional phones. Apple sent alerts to 110 countries. The student movement member whose iPhone was compromised was not a random activist—he was a node in a network that the elite wanted mapped. The Pegasus exploit is not the story; the story is that Citizen Lab, SHARE, and Amnesty International were allowed to confirm it. That is the tell. The system leaks information deliberately, to create the illusion of transparency while the real operations remain invisible. The question you must sit with is this: why did the same spyware that targeted a Serbian student also appear on devices in Mexico, Thailand, and Poland? Look at the dates. Look at the election cycles. Look at the foundations that fund the NGOs that “expose” the hacking. The answer is not in Belgrade. It is in the boardrooms and the intelligence liaison offices where the real decisions are made. The trail is open. Follow it.