Update
Former SNS activist describes paid groups deployed against p...
In an interview with BIRN, a long-time member of the ruling party alleges that groups of men were pa...
On 19 October 2026, the SHARE Foundation and the Citizen Lab at the University of Toronto published two new cases of mercenary spyware targeting in Serbia. Citizen Lab confirmed with high confidence that the iPhone of Prof. Vladan Đokić, rector of the University of Belgrade, was infected with Pegasus, the spyware produced by the Israeli NSO Group. The infection took place during 2026 through a zero-click exploit, meaning that the target did not have to open a link or a file for the phone to be compromised. The exact date of the infection has not been established, and the investigation is ongoing.
The second case concerns Rade Bajić, a senior prosecutorial associate at the Public Prosecutor's Office for Organized Crime. On 13 August 2026 he received an official Apple threat notification, followed by a reminder on 27 August, stating that his device had likely been targeted with mercenary spyware. Citizen Lab treats such a notification as a high-confidence indicator of targeting, but an infection of his device has not been confirmed, and forensic analysis is still under way.
Both targets have been publicly associated with positions at odds with the authorities. Đokić has defended university autonomy and supported the student protests; on 31 March 2026 the criminal police entered the Rectorate building on the order of the Higher Public Prosecutor's Office. Bajić worked on the Generalštab case, in which the prosecution opened the question of criminal liability of state officials over the removal of protected status from the General Staff complex in Belgrade. He was subsequently removed from the case and, in February 2026, stated publicly that the prosecution was ready to hold to account all officials who had violated the Constitution and the law. Citizen Lab does not name the operator of the spyware in these cases. Pegasus, however, is sold only to states and government agencies.
The two cases follow the SHARE Foundation's finding of 2 September 2026 that at least 14 people - members of the student movement, activists, an opposition MP and a local councillor - had been targeted with advanced spyware since the beginning of the year. According to Citizen Lab, at least 16 members of Serbian civil society are now publicly known to have been targeted or infected with mercenary spyware. Earlier cases include the 2024 use of spyware against activists and journalists, linked to the Security Intelligence Agency (BIA) and the police, the Pegasus attempts against two BIRN journalists in 2025, and the surveillance of farmers reported by BIRN in December 2025. CRTA.Plus reported on the September findings and documented the earlier cases in a chronology of spyware surveillance. The new cases indicate that the targeting has extended beyond journalists and activists to the head of the country's largest university and to a member of the prosecution service who worked on a case concerning state officials.
Installing such software on someone's device is a criminal offence under Serbia's Criminal Code. On 6 October 2026, lawyers for student Jelena Kontić filed a criminal complaint with the Prosecutor's Office for High-Tech Crime against unidentified persons in the BIA and the police over Pegasus on her phone. Nevertheless, none of the complaints filed since 2024 has so far led to an identified perpetrator, and no state body has responded to the findings. In May 2025 the European Parliament deplored the large-scale illegal surveillance practices using spyware against activists, journalists and civil society in Serbia, and the European Commission stated that it had raised the issue with the Serbian authorities. The gap between these concerns and the absence of any investigative result is a matter of track record, not of legislation.
The findings come six days before the early parliamentary elections of 25 October. CRTA Election Observation Mission recorded in its first interim report that, since the elections were called, Informer TV had broadcast at least ten recordings of wiretapped conversations relating to the Student List, without stating who made them, when or how. Unlawful surveillance that goes uninvestigated has a chilling effect on everyone who takes part in public life, and that effect is strongest during an election campaign.
CRTA will follow whether the prosecution acts on these findings.
The second case concerns Rade Bajić, a senior prosecutorial associate at the Public Prosecutor's Office for Organized Crime. On 13 August 2026 he received an official Apple threat notification, followed by a reminder on 27 August, stating that his device had likely been targeted with mercenary spyware. Citizen Lab treats such a notification as a high-confidence indicator of targeting, but an infection of his device has not been confirmed, and forensic analysis is still under way.
Both targets have been publicly associated with positions at odds with the authorities. Đokić has defended university autonomy and supported the student protests; on 31 March 2026 the criminal police entered the Rectorate building on the order of the Higher Public Prosecutor's Office. Bajić worked on the Generalštab case, in which the prosecution opened the question of criminal liability of state officials over the removal of protected status from the General Staff complex in Belgrade. He was subsequently removed from the case and, in February 2026, stated publicly that the prosecution was ready to hold to account all officials who had violated the Constitution and the law. Citizen Lab does not name the operator of the spyware in these cases. Pegasus, however, is sold only to states and government agencies.
The two cases follow the SHARE Foundation's finding of 2 September 2026 that at least 14 people - members of the student movement, activists, an opposition MP and a local councillor - had been targeted with advanced spyware since the beginning of the year. According to Citizen Lab, at least 16 members of Serbian civil society are now publicly known to have been targeted or infected with mercenary spyware. Earlier cases include the 2024 use of spyware against activists and journalists, linked to the Security Intelligence Agency (BIA) and the police, the Pegasus attempts against two BIRN journalists in 2025, and the surveillance of farmers reported by BIRN in December 2025. CRTA.Plus reported on the September findings and documented the earlier cases in a chronology of spyware surveillance. The new cases indicate that the targeting has extended beyond journalists and activists to the head of the country's largest university and to a member of the prosecution service who worked on a case concerning state officials.
Unlawful surveillance that goes uninvestigated has a chilling effect on everyone who takes part in public life, and that effect is strongest during an election campaign.
Installing such software on someone's device is a criminal offence under Serbia's Criminal Code. On 6 October 2026, lawyers for student Jelena Kontić filed a criminal complaint with the Prosecutor's Office for High-Tech Crime against unidentified persons in the BIA and the police over Pegasus on her phone. Nevertheless, none of the complaints filed since 2024 has so far led to an identified perpetrator, and no state body has responded to the findings. In May 2025 the European Parliament deplored the large-scale illegal surveillance practices using spyware against activists, journalists and civil society in Serbia, and the European Commission stated that it had raised the issue with the Serbian authorities. The gap between these concerns and the absence of any investigative result is a matter of track record, not of legislation.
The findings come six days before the early parliamentary elections of 25 October. CRTA Election Observation Mission recorded in its first interim report that, since the elections were called, Informer TV had broadcast at least ten recordings of wiretapped conversations relating to the Student List, without stating who made them, when or how. Unlawful surveillance that goes uninvestigated has a chilling effect on everyone who takes part in public life, and that effect is strongest during an election campaign.
CRTA will follow whether the prosecution acts on these findings.
