Prosecutor Investigating Trump's $500M Tower Project Was Targeted With Spyware, Researchers Find

A Serbian legal official involved in a politically sensitive corruption investigation received an Apple warning indicating that his iPhone was likely targeted by mercenary spyware, raising fresh concerns about the security of investigations involving powerful interests.

Rade Bajić, a senior prosecutorial associate at Serbia's Public Prosecutor's Office for Organised Crime, received the notification in August 2026. He had worked on a criminal investigation into alleged wrongdoing surrounding a proposed $500 million (£375 million) development linked to Donald Trump's family.

Researchers have not confirmed that Bajić's phone was infected or identified who may have been behind the suspected targeting. The unresolved case highlights a wider vulnerability: surveillance of legal officials, if successful, could expose sensitive communications and undermine confidence in investigations.

Apple Warning Leaves Key Questions Unanswered

The Citizen Lab research group, working with the SHARE Foundation, reported on 19 October that Bajić had received an Apple Threat Notification. The researchers described such alerts as high-confidence indicators that a person was likely targeted with mercenary spyware, including Pegasus, developed by NSO Group.

Bajić received the initial notification on 13 August and a reminder on 27 August. Citizen Lab said its forensic analysis of material collected from his device was ongoing, meaning a successful infection has not been established publicly.

Bajić believes his work on the corruption investigation may have made him a target. 'In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack,' he said.

That is his assessment, not an independently established explanation for the alert. Neither the notification itself nor the researchers' preliminary finding identifies who was responsible. There is currently no confirmed public evidence linking the suspected targeting to the Serbian government, President Aleksandar Vučić, or anyone associated with the proposed development.

Why Prosecutor Phone Security Matters

A prosecutor's phone can contain more than personal messages. Depending on how it is used, it may hold communications with colleagues, contacts relevant to an investigation, documents, or information about investigative plans. If a device is compromised, such material could potentially be exposed.

There is no evidence publicly confirming that any of Bajić's information was accessed. The risk is nevertheless significant for investigations involving alleged official corruption, where confidentiality may be essential to protecting witnesses, preserving evidence, and preventing interference.

The case also raises a practical question for institutions responsible for sensitive investigations: whether security arrangements adequately account for threats against individual officials, not just the networks and systems they use. A warning of suspected targeting is not proof of a breach, but it is a reason to take the possibility seriously.

The Tower Case Sits Within a Wider Surveillance Concern

The investigation involving Bajić concerns the General Staff complex in Belgrade, a former military headquarters damaged during NATO's 1999 bombing campaign and designated a protected cultural heritage site. Prosecutors opened an investigation in 2024 after an anonymous complaint alleging public corruption over efforts to remove the site's protected status and enable redevelopment.

The proposed project was associated with Jared Kushner's investment firm. The development was later abandoned amid the controversy and criminal proceedings. Allegations surrounding the removal of the site's protections should not be treated as proven criminal conduct, and the existence of the spyware warning does not establish a connection between the two cases.

Serbia has faced wider scrutiny over digital surveillance. In December 2024, Amnesty International reported evidence that Serbian police and intelligence authorities had used the NoviSpy spyware system and Cellebrite mobile-forensics tools against journalists and activists. Those findings provide context for concerns about surveillance in the country, but they do not establish who was responsible for the suspected targeting of Bajić.

A separate case reported by Citizen Lab in October 2026 involved University of Belgrade rector Vladan Đokić, whose phone researchers said had been infected with Pegasus. Unlike Bajić's case, that finding was based on forensic analysis of his device.

For Bajić, the central questions remain unanswered: whether his phone was successfully compromised and who, if anyone, attempted to access it. Until investigators establish those facts, the case is a serious warning about the potential risks facing sensitive legal work, not proof of who was behind an attack.