Serbian prosecutor in Trump Tower inquiry targeted by Israeli spyware

A prosecutor investigating corruption allegations surrounding a real estate project linked to US President Donald Trump in Serbia was targeted with spyware, a new investigation has revealed.

The findings, published by the University of Toronto’s Citizen Lab alongside the Serbia-based digital rights group SHARE Foundation, showed that Rade Bajić, who served at the Prosecutor’s Office for Organized Crime, was selected as a target.

Bajić became a target of the Pegasus spyware developed by Israel-based NSO Group after he publicly spoke out about political interference and abuses of power.

The prosecutor stated that on 13 August, he received a warning alert from Apple cautioning him against state-sponsored or mercenary spyware attacks.

Project cancelled, but investigation and pressure continue

The probe centres on a plan to transform the historic complex in Belgrade that housed the former Yugoslav Ministry of Defence headquarters into a luxury Trump Tower skyscraper.

Linked to US President Trump’s son-in-law Jared Kushner, the real estate development drew fierce backlash amid political pressure disputes and allegations that the site’s protected heritage status had been unlawfully revoked.

The investment firm founded by Kushner announced late last year that it was pulling out of the project, citing respect for the Serbian public and the city of Belgrade.

Recalling his investigation into claims that senior government officials had improperly lifted the historic military complex’s protected status, former prosecutor Bajić said: “In my opinion, my role in this case was the sole reason for the illegal spyware attack.”

Target list widens to university and judicial figures

The spyware scandal in Serbia has widened, sweeping in political opposition figures, civil society, and academic circles.

It was also confirmed that an iPhone belonging to University of Belgrade Rector Vladan Đokić was infiltrated by Pegasus spyware.

Đokić, who refused to back the government’s crackdowns on student demonstrations, has become one of the prominent figures of the protest movement.

Police raided his office on 31 March, seizing his computers and servers. Đokić had also been touted as a likely leader for a student-backed opposition list ahead of early general elections scheduled for Sunday.

Shortly before the report was published, a pro-government tabloid released audio recordings allegedly capturing Đokić discussing his political ambitions, putting him directly in the crosshairs.

While the source of the recordings remained undisclosed, Đokić stressed that the breach of his phone represented a grave assault on his personal privacy, safety, and the dignity of the rector’s office, demanding that those responsible be punished.

State institutions silent on allegations

Speaking to Politico, SHARE Foundation policy advisor Andrijana Ristić noted that surveillance operations had spread from civil society and journalists to student activists, politicians, and finally to members of academia and the judiciary.

Ristić stated that the lack of state action despite formal criminal complaints has fuelled this escalation.

Citizen Lab senior researcher John Scott-Railton emphasized that technology from NSO Group, which claims to turn over a new leaf every time an abuse is uncovered, is being deployed directly for repression.

Scott-Railton pointed out that targeting individuals who defend freedom against corruption was no coincidence.

The Serbian Ministry of Internal Affairs left questions unanswered, though officials had previously denied allegations of cyber espionage.

NSO Group, which maintains that it sells its products exclusively to governments and was blacklisted by the US government in 2021 over human rights abuses, also made no comment.

Apple confirmed that it had sent mass threat notifications to users on 13 August, but provided no specific details regarding the cases of Bajić or Đokić.

In September, Citizen Lab and the SHARE Foundation disclosed that at least 14 individuals, including student activists and opposition figures, had received similar spyware alerts.