Citizen Lab Reports Pegasus Spyware Deployed Against Serbian Protest Figures Days Before Elections

Analysis
Confidence is low because only one forensic case, the Bajić device, is pending and no public count exists of other Apple Threat Notification recipients awaiting screening. Citizen Lab, Amnesty, Access Now, or SHARE will likely publicly confirm mercenary spyware on at least one more Serbian civil society figure by November 20, 2026. The Đokić zero-click infection shows that targets with no phishing exposure can still be compromised, so ordinary caution offers little protection. The October 25 vote gives the buyer of this surveillance a motive to keep operating and gives researchers a reason to publish quickly. SHARE's screening pipeline, which produced the 16 publicly known cases, remains the main channel for the next confirmation. Reporting rests on one investigative stream, since Citizen Lab and Balkan Insight anchor it and the secondary outlets only track the same release. The disclosure cluster may instead reflect release timing around the election and SHARE's growing screening capacity, so confirmations could slow after the vote. Confirmation would push opposition parties, EU observers, and digital-rights funders to expand device screening and Lockdown Mode rollout for candidates, while its absence would let them treat 16 cases as the working scope.