A zero-click spyware attack is a cyberattack in which malicious spyware is installed on a device without requiring the target to click a link, open a file, or otherwise interact with the attack. The term is used to describe infections that can occur automatically when a vulnerable system receives or processes malicious content.

Zero-click attacks may rely on undisclosed software weaknesses, sometimes described as zero-day vulnerabilities, because the affected developers do not yet know about the flaw or have not issued a patch. In such cases, users may be exposed before a fix is available.

Examples

Public research on commercial surveillance tools has documented zero-click methods. Pegasus, created by NSO Group, has been reported to use zero-click exploits to remotely install spyware on mobile devices. The FORCEDENTRY exploit is one example associated with deploying Pegasus on Apple devices.

Why it matters

News reporting on a Citizen Lab investigation describes a concern that targeted advertising systems can be abused to deliver malicious content that enables zero-click spyware infections. Because the attack does not require user action, traditional warnings about clicking suspicious links may not prevent such attacks.

Once installed, spyware can give an operator covert access to a device, including capabilities such as reading messages, tracking location, or activating the microphone or camera, depending on the tool and the compromised system.