What Happened
The Hacker News reports Citizen Lab confirmed a zero-click Pegasus infection on the iPhone of Vladan Đokić, rector of the University of Belgrade, on October 19. Citizen Lab reached the finding with high confidence. The lab was unable to date the infection beyond 2026, did not name the operator, and says its investigation continues. The disclosure arrived six days before Serbia’s October 25 snap election. Citizen Lab also flagged a prosecutorial associate who received Apple Threat Notifications in August. The SHARE Foundation counts at least 14 people in Serbia targeted with spyware this year. Serbia’s BIA security service has rejected earlier allegations.
Why This Matters for Canadian Organizations
Citizen Lab is a research group at the University of Toronto. Its forensic work is the reason this infection is public. Canadian universities, newsrooms, law firms, and civil society groups employ the same kind of people commercial spyware vendors sell to target.
A zero-click exploit needs no action from the victim. Phishing training does not stop it. A compromised phone also holds personal information about colleagues, clients, and sources, so an infection raises breach assessment questions under PIPEDA as well as security questions.
What to Do
Identify staff who face elevated risk, including executives, journalists, researchers, lawyers, and advisers to government. Enable Lockdown Mode on their iPhones and keep iOS current. Treat any Apple Threat Notification as a sign of infection until an expert reviews the device. Route those reports to your incident response team, not the help desk. Citizen Lab points at-risk people to Access Now’s Digital Security Helpline. Read more in our Trends coverage and our News archive.
