Zero-click exploit
Also known as: zero-click attack, zero click exploit, 0-click exploit, interaction-less exploit
A zero-click exploit is an attack that compromises a device without any action from the victim, no link to click and no file to open.
It usually targets software that automatically processes incoming data, such as messaging apps that preview images. Zero-click attacks are rare, expensive, and mostly used by spyware vendors against journalists, activists, and officials. While ordinary users are unlikely targets, keeping phones updated and using protective modes helps those at higher risk.
Zero-click exploit, explained at three levels
At home
Most hacks need you to click something. A zero-click attack doesn't. Simply receiving a booby-trapped message can let attackers into the phone.
At work
Zero-click attacks target high-value people such as executives, journalists, and officials, who need extra protection.
At home
Apps that automatically preview photos, videos, or links are common targets, because they process data before you ever open it. Updating your phone quickly closes known holes.
At work
Zero-click exploits usually chain several vulnerabilities to escape security sandboxes. They're expensive to develop and often sold by commercial spyware vendors to governments. Indicators are hard to spot, so forensic tools and specialist help may be needed.
At home
Most people will never face a zero-click attack. In my opinion, if you're a journalist, activist, or lawyer handling sensitive cases, turning on Lockdown Mode or Android's Advanced Protection is worth the inconvenience.
At work
Protect at-risk staff with rapid OS updates, hardened modes, regular device reboots (which can clear some non-persistent implants), separate devices for sensitive work, and relationships with forensic experts such as Citizen Lab or Amnesty Tech for suspected compromise.
Real-world examples
At home
Jerome, an investigative reporter in Montreal, turned on Lockdown Mode on his iPhone after learning journalists had been targeted with zero-click spyware.
At work
Aisha is head of security at a Canadian human rights organization. She requires staff travelling to high-risk countries to use hardened phones, update immediately, and report anything unusual.
How it compares
| feature | Zero-click exploit | One-click exploit |
|---|---|---|
| Victim action needed | None | Clicking a link or opening a file |
| Cost to attackers | Very high | Lower |
| Typical targets | High-profile individuals | Broader groups |
| Best defence | Fast updates, hardened modes | Awareness plus updates |
One-click attacks need your help. Zero-click attacks don't.
For analysts
For executives and staff in sensitive roles, I'd set a policy of installing phone updates within a day. Zero-click attacks exploit the gap between a patch's release and its installation.
History & origin
Remote, no-interaction attacks have existed for years, but zero-click phone exploits drew public attention through research by Toronto's Citizen Lab and others. In 2019, WhatsApp revealed that a flaw in its calling feature had been used to install NSO Group's Pegasus spyware, and later sued NSO. In September 2021, Citizen Lab discovered FORCEDENTRY, a zero-click iMessage exploit used to install Pegasus, prompting an emergency Apple update. Apple introduced Lockdown Mode in 2022 for people at high risk, and in 2023 Citizen Lab found BLASTPASS, another zero-click exploit chain. The US government added NSO to an export blacklist in 2021. In my view, Citizen Lab has done more to expose commercial spyware than almost any government.