You probably know the standard security advice by heart. Don't tap strange links, don't open unknown attachments, and don't install apps from shady sources. That advice still matters, but a certain class of attack ignores it completely. A zero-click attack can take over your phone while it sits on your desk and you never touch it.
This guide breaks down what these attacks are, how attackers pull them off, which real incidents made headlines, and what you can actually do to lower your risk.
What Is a Zero-Click Attack?
A zero-click attack compromises a device without any action from its owner. The victim does not tap a link, open a file, or answer a call. The attacker simply sends data to the device, and a bug in the software that handles that data does the rest.
Three terms often show up together here:
- Zero-click vulnerability: a flaw in code that handles incoming data on its own, such as a message parser or an image decoder.
- Zero-click exploit: the technique an attacker uses to trigger that flaw through crafted input.
- Payload: what the attacker gets afterward, such as spyware, stolen files, or remote control.
Not every zero-click attack installs lasting malware. Some grab data once and disappear.
Zero-Click vs Zero-Day: What Is the Difference?
People mix up these two terms often. Zero-click describes how the attack runs: it needs no user action. Zero-day describes the bug: a flaw the vendor has not fixed yet. Many zero-click attacks rely on zero-day bugs, but one term covers the delivery method and the other covers the vulnerability.
Why Can a Phone Be Hacked Without Any Click?
Modern phones constantly prepare content for you. When a message arrives, your phone reads its format, builds a preview, generates a thumbnail, and sometimes even transcribes audio. Your email app renders previews. Your calling app negotiates audio formats before you pick up.
All of this convenience runs automatically, and that automatic code becomes the target. If an attacker finds a memory bug or a logic error in it, a carefully built file can trigger that bug the moment it lands.
How Does a Zero-Click Attack Work Step by Step?
Most campaigns follow a similar path:
- Finding the flaw. The attacker discovers a bug in an app, operating system, or firmware component that handles untrusted data without asking the user.
- Crafting the bait. They build a file or packet that looks ordinary but hits the bug. It might be a malformed image, a doctored video, a calendar invite, a document, or call setup data.
- Delivering it through a trusted channel. The payload arrives through a messaging app, email, a phone call, or the network.
- Automatic processing. The device handles the content in the background, and the exploit fires.
- Taking control. The attacker installs spyware, copies data, or keeps persistent access.
- Covering tracks. With control of the device, the attacker can delete the original message and suppress notifications.
The whole sequence can finish in a fraction of a second.
Zero-Click Attack Examples: Real Cases From WhatsApp, iPhone, Android and AI Tools
These attacks are not lab theory. Security researchers have documented several cases.
The WhatsApp Missed Call Spyware
In 2019, attackers abused a buffer overflow in WhatsApp's voice calling code. Placing a call to the target was enough to plant spyware, even when nobody answered. In some cases the call vanished from the call log afterward. Researchers tied the campaign to NSO Group, and WhatsApp shipped an urgent fix.
FORCEDENTRY and Pegasus on iPhone
In 2021, Citizen Lab analyzed the iPhone of a Bahraini activist and found a zero-click iMessage exploit it named FORCEDENTRY. The attack disguised a malicious PDF as a GIF, slipped past Apple's BlastDoor sandbox, and installed Pegasus spyware. Pegasus could read messages, track location, and switch on the camera and microphone. Apple patched the flaw in an emergency update.
Operation Triangulation
In 2023, Kaspersky found that iPhones belonging to its own staff had been hit through iMessage. The malware recorded audio, grabbed photos, and tracked location, then wiped itself to hide its presence.
The Bezos Video File
In 2018, Jeff Bezos received a WhatsApp video from Saudi Crown Prince Mohammed bin Salman. Investigators later linked the file to a quiet data leak from his iPhone that continued for months.
Paragon Targets WhatsApp Users
In 2025, WhatsApp disrupted a campaign that hit around 90 users in more than two dozen countries with malicious documents needing no interaction. WhatsApp blamed Paragon, an Israeli spyware vendor that sells to governments. The same year, Meta patched another WhatsApp bug that, combined with an Apple OS flaw, could deliver spyware without a tap.
Android Audio Decoding
Android phones now decode incoming voice messages so they can show transcripts. Google Project Zero researchers built a proof-of-concept chain against the Pixel 9 using bugs in Dolby Digital and Dolby Digital Plus decoding. Nobody spotted it in real attacks, but it showed how a helpful feature can open a door.
Can AI Assistants Be Hit by Zero-Click Attacks?
AI tools created a newer version of this problem. Researchers showed that hidden instructions planted in emails, calendar invites, or shared documents could make AI assistants like Gemini for Workspace and ChatGPT act on attacker commands. One technique, called ZombieAgent, abused ChatGPT's links to Gmail, Google Drive, and GitHub. The user only asked for routine help, and the assistant quietly followed instructions the attacker had hidden. Vendors patched these issues, but AI agents with wide access will keep attracting this kind of trick.
Can iPhones and Android Phones Get Zero-Click Attacks?
Yes, both platforms have faced them. iPhones saw FORCEDENTRY and Operation Triangulation, and both arrived through iMessage. Android phones face risks from media libraries, MMS handling, and features like automatic audio decoding, as the Pixel 9 research showed. Neither system is immune, and neither vendor can promise a bug-free messaging stack. What protects you on either platform is the same: fast updates, fewer installed apps, and a hardened mode if your work puts you at risk.
Why Are Zero-Click Attacks So Hard to Detect and Stop?
Your habits don't matter. Phishing needs a mistake. A zero-click exploit needs none, so even a careful expert can fall victim.
They hide inside trusted apps. Attackers aim at iMessage, WhatsApp, email clients, and media libraries because these apps run all the time and hold broad permissions.
They leave little evidence. The exploit runs inside system processes that rarely produce useful logs. Many victims never find out.
They cost a fortune. Working zero-click chains are rare, so they command huge prices. Apple pays up to $2 million for certain iPhone zero-click findings, and Google pays up to $1.5 million for qualifying Android chains. Black market buyers pay similar sums.
Who Is Most at Risk From Zero-Click Attacks?
Because these exploits are expensive, buyers usually spend them on high-value people:
- Journalists and human rights activists
- Politicians, diplomats, and government staff
- Business executives with access to sensitive deals
- Lawyers handling confidential cases
Regular users rarely face a custom zero-click campaign. Still, the bugs live in the same apps everyone uses, and exploit tools tend to spread over time. A patch you skip leaves you exposed once details go public.
What Data Can a Zero-Click Attack Steal?
Once spyware lands, an attacker may reach:
- Chats, including encrypted ones, read on the device itself
- Live camera and microphone feeds
- Precise location history
- Saved passwords and banking app sessions
- Photos, notes, and work files
- Contacts, call logs, and browsing history
The exact reach depends on the permissions of the hijacked component. Core messaging and media apps usually have a lot.
Can You Tell If You Have Been Hit by a Zero-Click Attack?
You can't reliably confirm a zero-click infection without forensic tools. These symptoms only justify a closer look when several appear together:
- Battery draining faster than usual
- Phone feeling warm while idle
- Mobile data use jumping for no clear reason
- Apps crashing or acting oddly
- Sudden slowdowns on a device that used to run smoothly
- Apps you never installed
How to Protect Yourself From Zero-Click Attacks
No single setting makes you immune, but these steps shrink your exposure a lot.
Update Everything, Fast
Patching is your strongest defense. Once a vendor ships a fix, attackers study it to hit people who haven't updated. Turn on automatic updates for your OS and apps, and install firmware updates too.
Restart Your Phone Weekly
Some spyware lives only in memory and doesn't survive a reboot. Certain Pegasus versions needed reinfection after a restart. A weekly reboot won't remove persistent malware, but it can knock out lighter implants.
Cut Down Your Attack Surface
Delete messaging apps you no longer use. Each one adds code that processes data from strangers. Install apps only from official stores, and don't jailbreak or root your phone, since that strips away built-in protections.
Turn On Lockdown Mode or Advanced Protection
iPhone users at real risk can enable Lockdown Mode, which blocks most message attachments, link previews, and FaceTime calls from unknown people. Android users can turn on Advanced Protection for a similar hardened setup.
Trim App Permissions
Review which apps can reach your camera, microphone, location, and contacts. A hijacked app can only abuse what you allowed.
Lock Down Your Accounts
Use a password manager with unique passwords and enable multi-factor authentication on email, banking, and cloud accounts. If attackers steal one credential, the damage stays contained.
Watch Your AI Assistants
If you link an AI assistant to your inbox, drive, or code repos, give it only the access it needs. Review actions it takes on connected services, and be wary of summaries from documents you didn't write.
Split Work and Personal Devices
If your job carries risk, keep sensitive work on a separate phone. One compromise then doesn't expose everything.
Get Expert Help When It Matters
If you work in journalism or activism and suspect targeting, contact Access Now's Digital Security Helpline. It offers free support for people at risk.
How Can Businesses Defend Against Zero-Click Attacks?
Companies face a bigger version of the same problem. Security awareness training can't help when no click happens, and every employee phone holds email, chats, and MFA prompts. Teams should enforce patch policies through device management, restrict media previews on managed phones, deploy mobile threat defense that flags odd behavior, and segment networks so one infected device can't reach everything.
Frequently Asked Questions
What is a zero-click attack in simple words?
It's a hack that infects your device without you doing anything. The attacker sends data that your phone processes automatically, and a hidden bug lets their code run.
Can a phone get hacked through a call you don't answer?
Yes. The 2019 WhatsApp case proved it. Phones process call setup data before you pick up, and a bug there can let attackers in.
Can iPhones get zero-click attacks?
Yes. FORCEDENTRY and Operation Triangulation both hit iPhones through iMessage. Keeping iOS updated and using Lockdown Mode if you face high risk are your best moves.
Can antivirus apps stop zero-click exploits?
Usually not at the moment of attack. Security apps may catch suspicious behavior or malware activity afterward, but prompt updates do far more to block the exploit itself.
Does restarting my phone remove spyware?
Sometimes. A restart clears memory-only implants but not malware that has gained persistence. Combine regular reboots with updates and, if needed, a factory reset.
What should I do if I think I've been hit?
Restart the device, install all updates, and change important passwords from a different, clean device. Watch your bank accounts closely, and reach out to a security professional if symptoms continue.
