Zero-Click Attacks Explained: How They Work, Cases and Defenses
How zero-click attacks infect devices with no user action, who they target, key cases, and defenses for individuals and organizations.
What Is a Zero-Click Attack
A zero-click attack is an intrusion technique that succeeds without any user action. Simply receiving a message or processing communications can trigger malicious processing on the device. Its defining characteristic is that it requires no opening of attachments or selecting of links. The main targets are mobile devices such as smartphones and tablets. Cases targeting government agencies, journalists, and corporate executives have been disclosed. Large-scale abuse affecting ordinary users has also been confirmed.
How It Differs from One-Click Attacks
Many conventional attacks are designed to induce user action. Typical methods prompt a choice through fake links or attachments. Zero-click attacks skip this inducement process. Organizing the differences makes them easier to understand.
- One-click type: Lures victims with spoofed emails or shortened URLs. Opening or tapping is the trigger condition. Training and detection can sometimes block them.
- Zero-click type: Triggered by receipt or automatic parsing alone. No need to even check notifications. Difficult to prevent through user vigilance.
- Ease of noticing harm: With the former, a memory of a suspicious action remains. With the latter, traces are scarce. Post-incident investigation tends to be difficult.
- Focus of countermeasures: For the former, education and blocking are effective. For the latter, update management and structural defense are central.
How Zero-Click Attacks Work
Attacks often proceed in four stages. The first stage is delivery. SMS, MMS, iMessage, WhatsApp, and email serve as delivery channels. The second stage is automatic parsing. The device interprets received content in advance and creates thumbnails for images and videos. The third stage is exploitation of vulnerabilities. Flaws in image processing, audio processing, and font processing are exploited. Through memory corruption and privilege escalation, unauthorized commands are executed. The fourth stage is persistence and external communication. Persistent components are placed on the device to communicate with a command server. Location data, call logs, and credentials are sent externally.
Apple’s official documentation (https://support.apple.com/ja-jp/HT212650) explains isolation of message parsing and strengthened execution restrictions. Google Project Zero (https://googleprojectzero.blogspot.com/) has also published analyses of remote intrusion into mobile devices.
Vulnerable Areas
Attack surfaces concentrate on parts that automatically process received content. Typical entry points are as follows.
- Messaging functions: Image processing in iMessage, RCS, and MMS becomes a target. Flaws during preview generation are exploited.
- Call and communication functions: Incoming-call handling in WhatsApp and FaceTime becomes a target. The fact that handling runs before answering is exploited.
- Email: HTML rendering and attachment prefetching become targets. Sync settings trigger automatic processing.
- Short-range communication: Discovery processing for Bluetooth, Wi-Fi, and ultra-wideband becomes a target. Flaws during nearby-device discovery are exploited.
- Media parsing: Decoding of images, videos, and fonts becomes a target. Format complexity tends to create flaws.
iOS is characterized by centralized management of iMessage. A flaw in one place can affect a wide range. Android varies greatly by model and vendor. How quickly updates arrive directly determines defensive strength.
Notable Cases
Pegasus and Abuse Targeting News Organizations
Pegasus is known as a surveillance program developed by NSO Group. Since 2016, Citizen Lab (https://citizenlab.ca/) has continuously published investigations. Multiple no-interaction intrusions exploiting iMessage flaws were confirmed. Collection of communications records was observed on devices of journalists and human rights groups. In 2021, Apple announced a lawsuit and strengthened security measures. Identifying victims required analysis of device logs.
Operation Triangulation
This is a case disclosed by Kaspersky (https://www.kaspersky.co.jp/) in 2023. Long-term intrusion activity targeting iOS devices was confirmed. It started with an invisible message via iMessage. Privileges were seized through a font-processing flaw. Persistence was observed on multiple devices, including business devices. It was also reported that some components disappear after a reboot.
WhatsApp Incoming-Call Handling Flaw
In 2019, CVE-2019-3568 was disclosed. A memory-corruption flaw existed in the VoIP incoming-call handling component. Unauthorized commands could be executed even without answering. WhatsApp strongly urged users to apply updates. Targeted abuse was confirmed, and the vendor took legal action. The case demonstrated that automatic processing in communication functions can become a danger point.
Why Detection Is Difficult
The first reason is that it leaves no memory for the user. There is no history of opening or tapping. Users are unlikely to become aware of any suspicious action. The second reason is erasure of traces. Volatile components may disappear after a reboot. Overwriting of logs loses evidence. The third reason is difficulty distinguishing attacks from legitimate communications. Attack traffic is often encrypted. It blends into large volumes of normal traffic. The fourth reason is concealment after privilege escalation. Functions for altering logs and evading monitoring are built in. Checking the device alone can miss anomalies.
Defenses for Individuals
Complete prevention is difficult, but the probability of harm can be reduced. High-priority measures are as follows.
- Update the OS and applications immediately. Enable automatic updates. Shorten the vulnerable period.
- Disable unnecessary communication features. Review use of iMessage and FaceTime. Reduce exposure.
- Consider Lockdown Mode. It targets devices running iOS 16 or later. Restrictions on attachments and links are strengthened.
- Restart regularly. This helps eliminate persistent components. About once a week is a guideline.
- Separate a spare device. Keep important contacts apart from daily use. This can limit the scope of damage.
- Maintain encrypted backups. Prepare for recovery after resetting the device. Generation management of backups is also important.
In practice, postponing updates is the greatest danger point. Disabling automatic connection to public Wi-Fi is also advisable. Record any unexplained reboots or battery drain. If abnormalities occur, consult your carrier or the manufacturer’s support desk.
Defenses and Operations for Organizations
In organizations, a combination of device management and monitoring is essential. Key points obtained through on-site reporting are summarized below.
- Enforce centralized device management: Visualize update status with MDM. Isolate unpatched devices. Also maintain an inventory of exception devices.
- Preserve communications logs: Retain DNS and proxy logs long-term. Use them for retrospective tracking of command communications. A retention period of at least 90 days is a guideline.
- Separation of privileges: Separate work and personal areas. Limit important operations to dedicated devices. Also restrict connection of external media.
- Establish initial response procedures: Collect logs before rebooting. Isolate in airplane mode. Secure backups before wiping.
- Prioritized protection for executives and public relations: Identify positions likely to be targeted. Consider applying Lockdown Mode. Lend alternative devices when traveling abroad.
When evaluating for deployment, avoid focusing only on numerical comparisons of detection rates. Judge including operational load and response procedures for false positives. For small organizations, outsourcing log management is practical. For large organizations, a platform for collecting device logs is effective.
Editorial Opinion
The evaluation criterion for comparison should be not whether detection occurs, but the ability to contain damage. Rather than whether a single device can defend itself, coordination with operational structures and monitoring infrastructure is important. Selecting based on deployment load and the cost-effectiveness of continuous monitoring is the reasonable approach.
The pitfall in the field is that delayed OS updates leave entry points open. In targeted attacks, no suspicious behavior often remains, and users frequently cannot notice anomalies. Neglecting preservation of backups and communications logs makes post-incident investigation difficult.
The future direction will be mainstream isolated execution of message-parsing processes. Targets will expand to satellite communications and in-vehicle devices, and the attack surface will grow. Preparing for attacks that succeed without interaction will become a standard operational requirement.
References
Frequently Asked Questions
- What is the difference between zero-click attacks and ordinary virus infections?
- Conventional types require opening an attachment or selecting a link as the trigger. Zero-click types execute through receipt or automatic parsing alone. The biggest difference is that they cannot be prevented by user vigilance. Countermeasures focus on update management and structural defense.
- Is iPhone Lockdown Mode effective?
- It is effective in reducing exposure by restricting attachment handling and communication features. It is suitable for positions with a high likelihood of being targeted. Because everyday convenience decreases, it must be balanced with operations. Decide on application based on threat level.
- Is rebooting effective against zero-click attacks?
- In some cases it can erase persistent components in volatile memory. It does not provide complete removal, but it helps contain damage. Combining regular reboots with applying updates is important. If abnormalities occur, prioritize preserving logs.
- What kind of posture should organizations establish?
- Visualizing updates through centralized device management and isolating unpatched devices is fundamental. Long-term retention of communications logs enables retrospective tracking. Prioritized protection for easily targeted functions such as executives and public relations is also necessary.
Comments