Serbian prosecutor who investigated Belgrade Trump tower project ‘targeted with spyware’

A Serbian prosecutor who investigated the authorities’ allegedly illegal scheme to help the Trumps build a tower in Belgrade has been targeted with advanced spyware, expert analysis indicates.

The finding suggests a disturbing new element in the authoritarian Serbian regime’s campaign to undermine what is believed to be the first criminal case related to global moneymaking drive of the US president’s family, which critics describe as a “pay to play” scheme trading the Trump administration’s favour for business opportunities.

Rade Bajić, the targeted prosecutor, said: “In my opinion, my involvement in this case was the sole reason for this unlawful spyware attack.”

Analysts at the Citizen Lab, a digital forensics laboratory, have not so far established who was behind the attack but the Serbian regime has previously been caught using spyware against its opponents.

News of the alleged hack follows the Guardian’s revelations last week that Aleksandar Vučić, Serbia’s president, personally ordered that a cherished site in Belgrade be stripped of its legal protection so it could be handed over for a $500m Trump hotel and tower. Vučić, one of the Balkans’ most influential nationalists, hosted the US president’s son Donald Jr – “dear Don”, as he calls him – and son-in-law Jared Kushner as he ingratiated himself with the Trumps.

At the weekend, Vučić responded to the Guardian’s revelations about his role in the scandal by confirming details of a previously secret meeting. He indicated he had done nothing wrong. “I fought for my people,” he said. “And that’s what I’ll continue to do in the future.”

Last year prosecutors brought a landmark indictment against senior members of Vučić’s regime, accusing them of abusing their office to unlawfully strip the General Staff building – a monument to Serbia’s recent difficult history – of its protected status. They face years in jail if convicted.

Kushner, who was leading the Trump Belgrade development, called off the plans after the charges were made public. Vučić vowed reprisals, denouncing the prosecutors, including Bajić, a member of the specialised organised-crime unit that brought the indictment.

Bajić has said he was taken off the case without explanation shortly before the indictment was published. He went on to address one of the rolling protests against the regime triggered by widespread corruption, telling demonstrators in February: “The law will be equal for all.”

In August, Bajić received a message from Apple saying it had “detected a targeted mercenary attack against your iPhone”.

Citizen Lab researchers, who have been analysing Bajić’s phone, said this was “a high confidence indicator that his device was likely targeted with mercenary spyware, such as Pegasus”.

Working with the Share Foundation, a Serbian rights group, they previously identified spyware attacks against anti-government protesters. In at least one case, the Citizen Lab analysts discovered Pegasus on a protester’s phone. “A zero-click infection with Pegasus spyware would not have been visible to the target, and would give the Pegasus attacker total access to the device,” they said of that discovery.

The Guardian’s Pegasus Project revealed how journalists, activists, politicians and others have been targeted by governments using the spyware. NSO Group, the Israel-based company that makes Pegasus, has been approached for comment.

Vučić, who stepped down late last month and called snap elections for 25 October, hoping to prolong his 12-year rule by switching from president to prime minister. He has been approached for comment, as has the prosecutors’ unit, which has said it may bring more charges in the General Staff building case.

Representatives of the Trumps and Kushner have denied they engaged in “pay to play” arrangements and said they were not involved in the Serbian authorities’ decision to strip the building of its protected status.