Zero-Click Exploit
A zero-click exploit is an attack method in which a device is compromised without the affected person having to click, open, or confirm anything. The attack takes place entirely in the background and is therefore particularly difficult to detect and prevent.
Normally, a digital attack requires someone to make a mistake: open a malicious attachment, click on a link, or visit a fake website. A zero-click exploit bypasses all of this entirely. The device is attacked without the affected person doing anything at all. A message arrives — and the device is already compromised, meaning it is under foreign control. The person notices nothing, sees nothing, and doesn’t have to confirm anything. The term is made up of “zero clicks” and “exploit,” the English word for the targeted exploitation of a security vulnerability in software.
Why zero-click exploits are so dangerous
In most attacks, the human is the weakest link. Security training, skepticism toward unknown senders, antivirus software — all of this assumes that the attack at some point passes through a human action. With a zero-click exploit, this moment doesn’t exist.
Even technically skilled, cautious people are defenseless, because no behavior helps them. This makes these attacks particularly valuable for state intelligence agencies and well-funded criminal groups. On the black market, zero-click exploits fetch prices in the millions — because they are rare, difficult to develop, and extremely effective. The Israeli company NSO Group reportedly charged several million dollars per license for its Pegasus spyware deployment, which was based on zero-click technology.
How a zero-click attack works technically
The key lies in the way apps process incoming data. When a message arrives on a smartphone, code runs automatically in the background: the messaging app unpacks the message, reads its content, loads preview images, evaluates metadata. All of this happens before you even tap the notification.
This is exactly where the attack comes in. Attackers construct a message designed in such a way that processing it triggers an error in the software — a so-called buffer overflow, in which more data is written into a memory area than there is space for. This error allows custom code to be injected and executed. The attacker is thus not exploiting a human error, but a programming error.
Apps that process complex file formats are particularly vulnerable: images, videos, voice messages, or calendar invitations. The more formats an app reads automatically, the larger the attack surface. Apple iMessage, WhatsApp, and similar services have all been affected in the past — not because they are poorly programmed, but because the task is simply difficult.
Zero-click exploits in practice and in the news
The best-known case is the Pegasus spyware, developed by NSO Group. Since at least 2019, Pegasus has used zero-click vulnerabilities in iMessage to take over the smartphones of journalists, human rights activists, and politicians worldwide. Citizen Lab, a research institute at the University of Toronto, documented infections in dozens of countries — without the victims ever having clicked on anything.
Apple responded in 2021 with an emergency update after a zero-click vulnerability was discovered that worked completely without any user interaction. Since then, Apple has introduced a feature called Lockdown Mode, which drastically reduces the attack surface — albeit at the cost of convenience and functionality. This trade-off illustrates the fundamental problem: there is no such thing as complete protection, only a reduced attack surface.
In the news, the term is encountered primarily in the context of surveillance software, intelligence operations, and smartphone security. Anyone who reads the term should know: this is not about ordinary malware, but about attacks at the highest technical level — developed by well-organized, often state-funded groups.