Serbian Spyware Investigation Highlights the Role of Mobile Forensics in Detecting Pegasus Attacks

A Serbian prosecutor who investigated an alleged corruption case involving a proposed Belgrade property development received an Apple warning that his iPhone had been targeted by mercenary spyware, raising renewed concerns about surveillance of public officials and civil society.

The prosecutor, Rade Bajić, received Apple threat notifications in August 2026. Researchers at the University of Toronto’s Citizen Lab assessed the alert as a high-confidence indicator that his device was likely targeted by spyware such as Pegasus. However, investigators have not yet confirmed that his phone was infected; forensic analysis remains ongoing.

The case emerged alongside a separate investigation involving Vladan Đokić, rector of the University of Belgrade. Citizen Lab reported with high confidence that forensic artefacts recovered from Đokić’s iPhone showed a Pegasus infection in 2026.

The researchers said the attack used a zero-click exploit, meaning the victim did not need to tap a link or open an attachment for the device to be compromised. The identity of the operator has not been established.

For digital forensic investigators, the cases demonstrate the importance of preserving device artefacts, examining system logs and traces of exploitation, and correlating technical findings with threat notifications and timelines.

Sophisticated spyware can operate covertly, making incident reconstruction difficult; a warning alone does not establish what data was accessed or who was responsible.

Citizen Lab and SHARE Foundation said their investigations into the cases were continuing. The findings add to earlier reports of advanced spyware targeting activists and opposition figures in Serbia, underscoring the need for independent technical analysis and careful attribution.