Another Serbian opposition leader’s phone was discovered to have been infected with powerful spyware, the latest in a series of such discoveries in the lead-up to national elections next week. 

The digital forensics research institute the Citizen Lab confirmed on Monday that University of Belgrade Rector Vladan Đokić’s phone was infected with Pegasus spyware sometime this year. Đokić has been a vocal supporter of a student protest movement calling for the permanent removal from government of Serbia’s former president, Aleksandar Vučić.

Vučić, who left the presidency just weeks ago due to term limits, is running for prime minister in elections to be held on October 25 and is widely expected to wrest back control of the country if reelected to a role he previously held from 2014-2017.

A second suspected victim’s device is still being analyzed by the Citizen Lab. Rade Bajić, a prosecutor who investigated alleged corruption involving a Vučić effort to sell a protected historic building to U.S. President Donald Trump’s son-in-law Jared Kushner, received an Apple threat notification in August, according to a press release from Serbia’s SHARE Foundation.

Apple notifications are widely considered high-confidence indicators of commercial spyware targeting.

The Serbian authorities have been using NSO Group’s Pegasus against regime opponents for some time. In 2026, the SHARE Foundation, along with the Citizen Lab and Amnesty International, have so far found that at least 15 people have been targeted with advanced spyware, according to the press release.

The continued use of Pegasus to target members of Serbian civil society battling an authoritarian regime raises significant questions about NSO Group’s repeated assurances that it does not do business with repressive governments that abuse its technology.

A spokesperson for the company did not respond to comment nor did a spokesperson for the Serbian embassy in Washington.

Serbian student protests have rocked Belgrade since November 2024 when anti-corruption demonstrations began. In recent months, several other students and journalists have been found to have been targeted with spyware.

“There’s been increasing physical and digital repression,” said Adrijana Ristić, a researcher at the SHARE Foundation. “The targeting has been very broad, not just in the sense of spyware —  there's confidential communications leaking… and attacks on journalists as well.” 

“The tensions are very high at this moment.”

Đokić is well-known for “refusing to facilitate a government-led crackdown on student protesters, which led to intense pressure from the Serbian authorities,” according to the Citizen Lab, which said Serbian authorities raided his offices, seizing computers and servers, in late March.

Bajić, the prosecutor who received an Apple notification for spyware, helped kill a deal between Vučić and Kushner for a Belgrade Trump Tower and charged government officials after finding forged documents underpinning the negotiations, Ristić said.

The Trump Tower project was planned to be built on the ruins of a protected cultural heritage site in the capital, the Citizen Lab said.

Bajić was transferred off the case in November 2025 with no explanation. In February, he spoke out against political repression at a demonstration. A month later other prosecutors filed an indictment against the country’s current Minister of Culture and three other senior government officials on charges relating to the failed Trump Tower deal.

The regime has been going after him for at least a year, he said. 

In November 2025, Vučić personally referred to him on state-run television as a “criminal from the Prosecutor’s Office for Organized Crime,” Bajić said.

‘It is evident that all of this is being done because our Prosecutor’s Office is conducting criminal proceedings against representatives of the executive branch of government,” he said. “My involvement in this case was the sole reason for this unlawful spyware attack.”