Citizen Lab disclosed on 19 October that the iPhone of Vladan Đokić, rector of the University of Belgrade, was infected with NSO Group's Pegasus spyware earlier in 2026, as The Hacker News reported the same day. The compromise was achieved through a zero-click exploit — Đokić did not need to tap a link, open a message, or interact with anything on the device. The disclosure landed six days before Serbia's 25 October snap parliamentary election, and Đokić is a visible supporter of the country's student protest movement.
Serbia's political context is the hook, but not the point for IT and security teams elsewhere. The technical finding is what matters: a high-profile iOS device was compromised in 2026 without any user action, using a chain capable of defeating the security model that most mobile policies still quietly depend on — that a reasonably careful user will not encounter the payload.
Why user training stops being a defence
Every security programme that frames iPhone risk around phishing awareness, link hygiene, or "don't open attachments from unknown senders" is addressing a threat vector this exploit does not use. When the infection happens on receipt — via a delivered message, call, or other push notification that the device processes silently — the human layer is simply not in the path. Whatever an organisation tells its executives about careful behaviour, it does not reduce exposure to this class of attack.
Nothing in Citizen Lab's report concerns Hong Kong, but the attacker capability it attributes is not jurisdiction-bound, which is why it belongs in any local threat model for high-profile iOS users. The relevant question is not whether a given organisation is a likely target of a Serbian election-related campaign; it is whether its current configuration would survive an equivalent chain aimed at a director, founder, or senior executive.
What actually helps
The countermeasure stack is not speculative:
- Apple Lockdown Mode for devices at elevated risk. It restricts precisely the attack surface zero-click chains rely on, and it is a deliberate trade of convenience for coverage. The friction is real — message previews, wired-only connections, some FaceTime group features, and web fonts all take a hit — but that trade should be a board-level decision, not one IT quietly defers.
- Patching without deferral for executive devices. Mobile device management policies that hold iOS updates in a staged rollout for compatibility testing leave high-value handsets on known-vulnerable builds. Executive devices should be first in the queue, not last.
- Compartmentalisation. Separate high-privilege or high-sensitivity activity from the primary handheld where practical; assume the executive device is the highest-value endpoint in the estate, because it is.
- Escalation path. Define in advance who is notified, and how quickly, if a device is suspected of compromise.
The detection reality check
Boards and executives should not be told that this will show up in MDM. Zero-click chains of this type typically publish no reliable indicators of compromise, and the first instance in a given environment will not match anything anyone is watching for. Detection is best-effort, not guaranteed:
- Apple's threat notifications for high-risk users, issued at Apple's discretion after the fact.
- Scheduled Mobile Verification Toolkit runs against device backups for elevated-risk handsets — a forensic, not real-time, capability.
- Telemetry anomalies: unexplained restarts, battery drain, or data spikes.
None of these reliably catch a novel chain in the act. Prevention — Lockdown Mode, aggressive patching, compartmentalisation — is the layer that can be trusted; detection is a backstop. Security teams briefing their leadership this quarter would do well to say so plainly, then ask whether the current configuration would survive the same exploit.
Citizen Lab 於10月19日披露，貝爾格萊德大學校長 Vladan Đokić 的 iPhone 於2026年早些時候感染了 NSO Group 的 Pegasus 間諜軟件，The Hacker News 同日報道了此事。該入侵透過零點擊漏洞達成——Đokić 無需點擊鏈接、開啟訊息，或與裝置上任何內容互動。該披露於塞爾維亞10月25日倉促舉行的議會選舉前六日公布，而 Đokić 是該國學生抗議運動的公開支持者。
塞爾維亞的政治背景是引子，但並非其他地區 IT 及安全團隊的重點。真正重要的是技術層面的發現：一部備受關注的 iOS 裝置於2026年在使用者無需任何操作的情況下被入侵，所用的攻擊鏈足以擊破大多數流動安全政策仍然默默依賴的安全模型——即一名謹慎的使用者不會接觸到惡意負載。
為何使用者培訓不再是有效防禦
所有將 iPhone 風險框架建立在釣魚認知、鏈接衛生，或「不要開啟不明寄件人附件」之上的安全計劃，所應對的威脅向量根本不是此漏洞所使用的。當感染在接收時便已發生——透過送達的訊息、通話，或其他由裝置靜默處理的推送通知——人為防線根本不在攻擊路徑之上。無論機構如何教導高管謹慎行事，都無法降低這類攻擊的暴露風險。
Citizen Lab 報告的內容並無涉及香港，但其所歸屬的攻擊者能力並不受司法管轄權限制，這正是該威脅應納入香港本地高知名度 iOS 使用者威脅模型的原因。相關問題並非某機構是否為塞爾維亞選舉相關行動的可能目標，而是其現行配置能否抵禦針對董事、創辦人或高層管理人員的同類攻擊鏈。
真正有效的對策
防禦措施組合並非空談：
- Apple 鎖定模式（Lockdown Mode），適用於風險較高的裝置。它精確限制了零點擊攻擊鏈所依賴的 attack surface，是刻意以便利性換取防護覆蓋的取捨。摩擦確實存在——訊息預覽、僅限有線連接、部分 FaceTime 群組功能及網頁字體均會受影響——但此取捨應由董事會層面決定，而非由 IT 部門默默拖延。
- 高管設備必須即時修補，不容延遲。 將 iOS 更新置於分階段部署（staged rollout）以進行兼容性測試的流動裝置管理（MDM）政策，會令高價值手機繼續運行已知存在漏洞的版本。高管設備應排在修補隊列首位，而非末位。
- 隔離分區（compartmentalisation）。 在可行情況下，將高權限或高敏感度活動與主要手持裝置分開；應假定高管設備是整個資產組合中價值最高的 endpoint，因為事實確實如此。
- 通報升級路徑。 預先界定一旦懷疑設備被入侵，誰會收到通知，以及通知時限。
檢測的現實檢驗
不應向董事會及高管聲稱此類入侵會在 MDM 中顯示。此類零點擊攻擊鏈通常不會公開可靠的 compromise indicators（入侵指標），而在特定環境中的首次出現，亦不會與任何人正在監控的任何特徵相符。檢測屬盡力而為（best-effort），並無保證：
- Apple 對高風險使用者發出的威脅通知，由 Apple 事後自行決定發出。
- 針對高風險手機的裝置備份定期執行 Mobile Verification Toolkit——屬取證能力，而非即時檢測。
- 遙測（telemetry）異常：無法解釋的重啟、電池耗電或數據流量飆升。
以上方法均無法可靠地在新型攻擊鏈實施當場將其截獲。預防措施——鎖定模式、積極修補、隔離分區——才是真正可倚賴的防線；檢測只是後備保障。安全團隊本季度向管理層作簡報時，最好直言這一點，然後追問現行配置能否抵禦同一漏洞的攻擊。