A digital rights group reported on Monday that spyware from an Israeli company had been used to target the phone of the University of Belgrade's rector, who has featured prominently in nearly two years of protests against Serbia's populist leader, Aleksandar Vucic.

This weekend, the Balkan country is holding a tense election that is widely regarded as a showdown between the protesting student movement and Vucic, who is seeking to extend his right-wing Serbian Progressive Party’s 14-year rule.

In September, digital rights groups reported that hackers had targeted at least 14 activists and students, infecting their phones with spyware, including NSO Group's Pegasus.

The Citizen Lab group, which conducts forensic analyses of spyware attacks, said in a statement that it could confirm with “high confidence” that Vladan Djokic’s phone had been infected with Pegasus spyware in 2026.

The group stated that it had conducted an analysis in collaboration with the Serbia-based SHARE Foundation, which is likewise a digital rights organization.

A separate analysis is underway to determine whether the phone of associate prosecutor Rade Bajic was also hacked.

Bajic worked on alleged corruption surrounding a real estate project linked to U.S. President Donald Trump’s son-in-law, which was later canceled.

Bajic received an Apple Threat Notification on his phone in August.

On Instagram, Djokic characterised the phone hacking as a “serious attack on my privacy, security and the integrity of the post of rector.”

He further remarked that it constituted “yet another attempt of intimidation designed to prevent any critical position and public action.”

There was no immediate comment from the Serbian authorities, which have denied in the past any involvement in such attacks, first reported in 2024.

Pegasus is spyware developed by the Israeli company NSO Group that can secretly infiltrate smartphones, enabling operators to read messages, track a user's location and activate microphones and cameras.

It can be installed through so-called zero-click attacks, which require no action by the phone's owner.

The SHARE Foundation warned that without an effective investigation, accountability, and a clear message that unlawful surveillance is unacceptable, “there is a serious risk that digital repression will continue and spread further, reaching every part of society and every critical voice.”

The student movement on Sunday warned that their meetings were being monitored and alleged that the authorities intended to detain a number of their colleagues ahead of a major rally on Thursday.

The police have not commented.

Scores of students have been detained in Serbia during protests over alleged anti-state activities.

Vucic, without offering any evidence, has repeatedly asserted that student protests have been orchestrated from abroad in order to “destroy” the country.

Protests erupted in November 2024, after a train station canopy collapse claimed 16 lives.

University students have demanded accountability for the tragedy in Novi Sad, which they say was caused by graft-fueled negligence during renovation work on the train station.

As the head of the University of Belgrade, Djokic has backed the protests and has resisted government pressure to bring an end to the faculty blockades staged by students in the capital.

In March, police raided Djokic’s offices, citing an investigation into a student’s death.

Bajic, the prosecutor, was replaced after he spoke out about alleged corruption linked to the government’s plan to turn the bombed-out former military compound into a luxury complex financed by a company linked to Jared Kushner.

A government minister and several others who were charged in the case are on trial in Serbia.

Israel’s NSO maintains that its technology is supplied to government agencies for the purpose of combating serious crime and terrorism.

However, investigations conducted by journalists and human rights researchers have documented its deployment against journalists, activists and other members of civil society.

In November 2021, the U.S. Commerce Department added NSO Group to its trade blacklist, citing evidence that foreign governments had used its spyware to target journalists, activists and government officials.

The designation restricts the company's access to U.S. goods and technology.