Rade Bajić, a member of Serbia's specialised organised-crime prosecution unit, was targeted with mercenary spyware after investigating the authorities' scheme to strip legal protections from a historic Belgrade site to make way for a $500m Trump hotel and tower. Apple warned Bajić in August that his iPhone had been hit with a "targeted mercenary attack." Citizen Lab, the University of Toronto digital forensics lab, assessed this as a high-confidence indicator of infection by military-grade spyware such as Pegasus. The spyware targeting followed a specific sequence of events. Bajić was part of the team that brought a landmark indictment against senior members of President Aleksandar Vučić's regime, accusing them of abusing their office to unlawfully strip the General Staff building — a monument to Serbia's recent history — of its protected status. Before the indictment was published, Bajić was removed from the case without explanation. He then went public, addressing anti-regime protesters in February and declaring "the law will be equal for all." The spyware notification arrived six months later. The broader pattern is now well-documented. The Guardian revealed last week that Vučić personally ordered the site's legal protections stripped so it could be handed to the Trump family's development. Vučić hosted Donald Trump Jr — "dear Don" — and Jared Kushner, who was leading the Belgrade project. After the criminal charges became public, Kushner pulled out and Vučić vowed reprisals against the prosecutors. Serbia's use of spyware against domestic opponents is not speculative. Amnesty International and Citizen Lab have previously documented the regime deploying Pegasus and Cellebrite forensic tools against journalists and activists. In at least one case involving anti-government protesters, Citizen Lab confirmed a zero-click Pegasus infection — invisible to the target, granting total device access. The Serbian regime has form, the tooling is confirmed, and the motive is specific. Vučić stepped down as president last month and called snap elections for 25 October, engineering a switch to prime minister to extend his 12-year rule. His response to the Guardian's revelations was to confirm details of a previously secret meeting while insisting he had done nothing wrong: "I fought for my people." The prosecutors' unit has indicated it may bring additional charges in the General Staff building case. The Trump family's exposure is indirect but structural. Representatives of the Trumps and Kushner deny any "pay to play" arrangement and say they were not involved in the Serbian decision to strip the building's protections. But the pattern — a foreign authoritarian clearing legal and physical obstacles for a Trump-branded development, then deploying state surveillance against the prosecutors who objected — describes a system where the Trump brand functions as a magnet for precisely this kind of governance corruption, whether or not the family directs it. NSO Group, the Israeli company that manufactures Pegasus, has been approached for comment. The prosecutors' unit that brought the original indictment has signalled further charges may follow. The case now sits at the intersection of transnational kleptocracy, mercenary surveillance, and the expanding footprint of the Trump business empire — and the question is whether any institution has both the jurisdiction and the will to follow all the threads.
