Citizen Lab confirms Pegasus zero-click on Belgrade rector six days before October 2025 snap election

Forensic artifacts from Đokić's device showed clear Pegasus indicators matching prior NSO Group infections analyzed by the lab. The infection granted full access including encrypted messages, microphone, and camera activation. SHARE Foundation coordinated the request after an earlier wave of 14 Serbian targets, twelve of whom received Apple Threat Notifications in August 2025. No infection date or operator attribution appears in the October 19 note, and analysis of prosecutor Rade Bajić's device remains incomplete despite two Apple alerts.

The timeline links directly to the Generalštab corruption probe into Kushner-linked Belgrade redevelopment, where Bajić was removed without explanation in November 2025. Serbian BIA rejected September allegations as sensationalism while claiming legal compliance, yet offered no technical rebuttal to the forensic matches. This pattern mirrors documented mercenary spyware use against opposition figures in election periods across multiple jurisdictions, where zero-click vectors bypass user interaction entirely.

Procurement records and prior Citizen Lab reports indicate Serbian services have acquired commercial intrusion tools; the absence of independent technical confirmation for BIA denials leaves the operator attribution gap unresolved. The two confirmed cases plus Bajić's notification extend the 2025 targeting wave beyond student activists to institutional figures handling high-profile graft investigations.

Next steps hinge on whether Citizen Lab publishes full indicators of compromise or timelines for Bajić's device and whether Serbian authorities permit independent forensic review of seized rector office equipment.