Zero-click attacks are one of the most dangerous and sophisticated forms of cyberattacks facing both ordinary users and organizations such as governments and news organizations today. Unlike more common phishing or social engineering techniques, which require the victim to click on a link or open a file, zero-click attacks require absolutely no user action to be activated. Infection can occur automatically, the moment a specially crafted message or file arrives on the phone or computer.
See also: Apple's 'AirBorne' flaws lead to zero-click AirPlay attacks
The basic principle behind zero-click attacks is based on exploiting software weaknesses at the operating system or communication application level, such as applications , email or push notification services. For example, an attacker can send an SMS or an image via an application such as iMessage or WhatsApp, which, due to a security flaw, will automatically process the content, allowing the attacker to install malware without the user realizing it. In many cases, these attacks take advantage of so-called zero-day exploits, i.e. vulnerabilities that have not yet been identified or patched by manufacturers.
See also: Zero-Click vulnerability in macOS Calendar allows malicious actions
The nature of zero-click attacks makes them particularly difficult to detect and analyze, even by experienced security researchers. The lack of visible evidence means that the victim can remain infected for a long time, with no clear trace of the initial infiltration. Furthermore, because zero-click attacks often target highly protected systems, such as iPhones and Android devices with the latest updates, their effectiveness requires highly specialized and precise techniques, which suggests the involvement of state-sponsored actors or advanced hacking.
One of the most well-known examples of such attacks is the Pegasus spyware from the Israeli company NSO Group, which used zero-click exploits to infiltrate high-profile devices, such as journalists, activists and politicians. The revelations of such attacks caused an international outcry and highlighted the need for stronger privacy and security protections in the digital world
See also: Nepalese hacker reveals Facebook's Zero-Click vulnerability
To combat zero-click attacks, users can adopt practices such as regularly updating their devices with the latest security patches, using encrypted communication apps, and minimizing the use of apps that automatically process incoming content. However, the ultimate solutions require broader systemic collaboration between technology companies, governments, and security researchers to identify and patch such serious vulnerabilities in a timely manner.
