# Pegasus spyware hits Serbian prosecutor, professor

Published: 2026-10-27 · Severity: routine · Sectors: Government (National), Education, Non-profit / NGO
Canonical: https://vorant.io/reports/756f19c7-b901-5dd4-ba29-8ce89a5e8329/pegasus-spyware-hits-serbian-prosecutor-professor
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Citizen Lab and SHARE Foundation found Pegasus spyware used against a Serbian prosecutor and professor tied to pro-democracy and Trump Tower Belgrade investigations.

Source: citizenlab.ca — https://citizenlab.ca/serbian-prosecutor-who-investigated-belgrade-trump-tower-project-targeted-with-spyware

## What to check

- Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

The Citizen Lab, working with the SHARE Foundation, has identified new victims of Pegasus spyware in Serbia: a university professor who is a prominent supporter of the country's student protest movement, and a prosecutor who investigated a scheme linked to a proposed Trump Tower development in Belgrade. These cases follow an earlier confirmed Pegasus infection of a Serbian pro-democracy student activist's device. Researchers now count at least 15 documented cases of Pegasus targeting in Serbia ahead of the country's October 25 national elections.

The pattern indicates a sustained surveillance effort against civil society figures, journalists, activists, and officials connected to politically sensitive investigations in Serbia, rather than an isolated incident. The targeting of a prosecutor investigating a matter connected to Trump family business dealings adds a notable political dimension. No technical indicators of compromise (hashes, infrastructure, or exploit details) were published in this report; the Citizen Lab's methodology typically involves forensic analysis of device backups to detect Pegasus artifacts.

Defenders in civil society organizations, legal, academic, and activist communities in Serbia and the broader region should be aware of ongoing mercenary spyware risk, particularly around the election period. Organizations supporting at-risk individuals should offer device forensic checks (e.g., via Mobile Verification Toolkit/Citizen Lab guidance) and encourage use of Lockdown Mode or similar hardened device configurations for high-risk individuals.

## Mentioned in this report

- Threat actors: NSO Group
- Malware: Pegasus

Source reporting: https://citizenlab.ca/serbian-prosecutor-who-investigated-belgrade-trump-tower-project-targeted-with-spyware

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/756f19c7-b901-5dd4-ba29-8ce89a5e8329/pegasus-spyware-hits-serbian-prosecutor-professor.
In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup