Serbian rector's phone was infected with spyware during student protests, group says

BELGRADE, Serbia (AP) — Spyware from an Israeli company was used to target the phone of the rector of the Belgrade university who has played a prominent role in nearly two years of protests against Serbia 's populist leader Aleksandar Vucic , a digital rights group said on Monday.

The Balkan country is holding a tense election this weekend that is seen as a showdown between the protesting student movement and Vucic, who is seeking to extend his right-wing Serbian Progressive Party’s 14-year rule.

In September, digital rights groups reported that at least 14 activists and students had their phones hacked and infected with spyware, including NSO Group’s Pegasus.

The Citizen Lab group, which carries out forensic analyses of spyware attacks, said in a statement that it could confirm with "high confidence" that Vladan Djokic's phone was infected with Pegasus spyware in 2026.

The group said it carried out an analysis in cooperation with Serbia-based SHARE Foundation, also a digital rights group.

A separate analysis is underway to determine whether the phone of associate prosecutor Rade Bajic was also hacked. Bajic worked on an alleged corruption surrounding a real estate project linked to U.S. President Donald Trump's son-in-law, which was later canceled. Bajic received an Apple Threat Notification on his phone in August.

There was no immediate comment from the Serbian authorities. They have denied in the past they were behind such attacks, which were first reported in 2024.

Pegasus is spyware developed by the Israeli company NSO Group that can secretly infiltrate smartphones, allowing operators to read messages, track a user’s location and activate microphones and cameras. It can be installed through so-called zero-click attacks, which require no action by the phone’s owner.

The SHARE Foundation said that without an effective investigation, accountability and a message that unlawful surveillance is unacceptable, "there is a serious risk that digital repression will continue and spread further, reaching every part of society and every critical voice.”

The student movement on Sunday warned that their meetings were being monitored and alleged that authorities planned to detain a number of their colleagues ahead of a major rally on Thursday. Police have not commented.

Scores of students have been detained in Serbia during protests for alleged anti-state activities. Vucic, without offering evidence, has repeatedly claimed that student protests have been organized from abroad to “destroy” the country.

Protests erupted in November 2024, after a train station canopy collapse killed 16 people. University students have demanded accountability for the tragedy in Novi Sad that they say was caused by graft-fueled negligence during renovation work on the train station.

Djokic has supported the protests as the head of the University of Belgrade, and has refused government pressure to end faculty blockades by the students in the capital. Police raided Djokic's offices in March, citing an investigation into a student's death.

Bajic, the prosecutor, was replaced after he spoke out about alleged corruption linked to the government's plan to turn the bombed-out former military compound into a luxury complex financed by a company linked to Jared Kushner . A government minister and several others who were charged in the case are on trial in Serbia.

Israel's NSO says its technology is sold to government agencies to combat serious crime and terrorism. But investigations by journalists and human rights researchers have documented its use against journalists, activists and other members of civil society.

The U.S. Commerce Department placed NSO Group on its trade blacklist in November 2021, citing evidence that foreign governments used its spyware to target journalists, activists and government officials. The designation restricts the company’s access to U.S. goods and technology.