Pegasus spyware hits Serbian prosecutor, professor
Citizen Lab and SHARE Foundation found Pegasus spyware used against a Serbian prosecutor and professor tied to pro-democracy and Trump Tower Belgrade investigations.
Sourcecitizenlab.ca — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Citizen Lab, working with the SHARE Foundation, has identified new victims of Pegasus spyware in Serbia: a university professor who is a prominent supporter of the country's student protest movement, and a prosecutor who investigated a scheme linked to a proposed Trump Tower development in Belgrade. These cases follow an earlier confirmed Pegasus infection of a Serbian pro-democracy student activist's device. Researchers now count at least 15 documented cases of Pegasus targeting in Serbia ahead of the country's October 25 national elections.
The pattern indicates a sustained surveillance effort against civil society figures, journalists, activists, and officials connected to politically sensitive investigations in Serbia, rather than an isolated incident. The targeting of a prosecutor investigating a matter connected to Trump family business dealings adds a notable political dimension. No technical indicators of compromise (hashes, infrastructure, or exploit details) were published in this report; the Citizen Lab's methodology typically involves forensic analysis of device backups to detect Pegasus artifacts.
Defenders in civil society organizations, legal, academic, and activist communities in Serbia and the broader region should be aware of ongoing mercenary spyware risk, particularly around the election period. Organizations supporting at-risk individuals should offer device forensic checks (e.g., via Mobile Verification Toolkit/Citizen Lab guidance) and encourage use of Lockdown Mode or similar hardened device configurations for high-risk individuals.
Mentioned in this report
Source reporting: https://citizenlab.ca/serbian-prosecutor-who-investigated-belgrade-trump-tower-project-targeted-with-spyware
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,325 reports from 144 sources, 625 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs