What happened
It has been confirmed that an iPhone belonging to Vladan Đokić, the rector of the University of Belgrade and a supporter of Serbia’s student protest movement, was infected with Pegasus spyware shortly before a national election. The infection involved a zero-click exploit, which required no user interaction such as opening a link or file. The spyware used was developed by NSO Group and the attack was actively exploited in the wild. The infection was identified on October 19, 2026, six days prior to the snap parliamentary elections scheduled for October 25. No vendor patch was available at the time of disclosure, indicating the exploitation was of a zero-day vulnerability.
Who is affected
Affected deployments include mobile devices that are vulnerable to the specific zero-click exploit used in this incident, particularly those running iOS versions susceptible to Pegasus spyware. While the specific model and software details are not available, the incident underscores the risk to political figures and individuals targeted by advanced persistent threat (APT) actors using highly sophisticated exploit techniques. Any organisation or individual with similar configurations should consider this threat as potentially relevant to their environment.
Recommended actions
- Implement network monitoring to detect early signs ofunauthorised connections or data exfiltration related to mobile device activity.
- Review mobile security policies, and monitor for suspicious behaviour on devices associated with political figures or high-profile targets.
- Ensure mobile software is kept up-to-date in accordance with official security advisories, even though a patch for the specific zero-day exploit was not available at the time of the incident.
- Consider deploying mobile device management (MDM) solutions that can help identify signs of compromise or malicious modifications.
- Maintain awareness of security alerts related to Pegasus spyware and other advanced threats targeting mobile devices.
