A zero-click attack breaks into a device without the user doing anything wrong — no link to tap, no attachment to open, no approval to accept. The exploit rides inside an ordinary message or file, the device's own software does the damage, and there is often nothing visible to warn you. This guide covers how zero-click attacks work, who actually uses them, and what they do and do not change about how a small business should spend its security effort in 2026.
TL;DR
- A zero-click attack compromises a device with no interaction at all: no click, no download, no MFA approval.
- The best-documented example is FORCEDENTRY, the iMessage zero-click exploit behind Pegasus spyware infections, which arrived inside a malicious PDF.
- These exploits are expensive, target-specific weapons; almost every attack a staff member will ever face is the click-required kind.
- Prompt updates are the main technical defence — most known zero-click chains die with the vendor's next patch.
- Training still matters more, because commodity phishing, not zero-click espionage, is what actually breaches Australian businesses.
What is a zero-click attack?
Every attack most people have heard of needs a human moment: you click the link, open the invoice, enter the password, approve the sign-in. A zero-click attack removes that moment entirely. The attacker finds a flaw in code that runs automatically when a message or file arrives — an image renderer, a messaging app's attachment parser, a network protocol — and crafts input that triggers it before any person touches anything.
The difference matters because every defence built around the human decision — awareness training, report buttons, phishing simulations — has no chance to fire. The researchers at The Citizen Lab, who document these cases more than anyone, describe zero-click infections as completely invisible to the target: the phone behaves normally while spyware silently harvests messages, microphone and camera.
How a zero-click attack works
The mechanics vary by target, but the chain has three steps:
- Delivery. The exploit is smuggled into something the device processes on its own. A text message, a shared image, a calendar invite, a VoIP call packet — anything parsed by code that runs before the user reads or reacts.
- Exploitation. The crafted input corrupts memory or abuses a logic flaw in that parsing code, letting the attacker run their own instructions with the app's privileges. In the FORCEDENTRY case, a malicious PDF sent to iMessage exploited Apple's image rendering library; Apple fixed it as CVE-2021-30860.
- Implant. The exploit installs spyware or malware that persists, escalates privileges, and starts collecting data — messages, locations, credentials, microphone and camera — and quietly exfiltrates it.
No step involves the user. That is why these exploits trade at the top of the market and why they are catalogued alongside nation-state tooling rather than commodity cybercrime.
Zero-click versus phishing: which should you actually worry about?
| Zero-click attack | Phishing (click-required) | |
|---|---|---|
| User action needed | None | A click, reply, entry or approval |
| Typical attacker | State-linked or well-funded teams | Anyone, from script kiddies to organised crime |
| Cost to attacker | Very high, often one-shot exploits | Near zero — kits and templates are rented |
| Targets | Specific individuals and executives | Everyone with an inbox |
| Main defence | Fast patching, modern devices, update discipline | Trained staff, reporting culture, filters |
The honest comparison: zero-click is real and documented, but it is a sniper rifle. Phishing is the machine gun pointed at every inbox in the country — ASD received more than 84,700 cybercrime reports in FY2024-25, one every six minutes, with the average self-reported cost for a small business at $56,600 (ASD Annual Cyber Threat Report 2024-25). Budget and training time should follow that ratio.
Who uses zero-click exploits in practice
The documented users are mercenary spyware vendors selling to government clients, and the targets are activists, journalists, opposition figures and diplomats. The Citizen Lab's FORCEDENTRY report documented NSO Group's Pegasus spyware infecting fully patched Apple devices through the iMessage zero-click exploit in 2021. The pattern has not stopped: in a 2026 report, the same lab confirmed an iMessage zero-click infection of a Serbian pro-democracy activist across December 2025 to January 2026, neutralised by Apple's patch in iOS 18.4.1.
Two lessons sit in those reports. First, the exploits target the messaging and media-parsing layer, not the email inbox. Second, every one of them was eventually fixed by a software update — the victim's protection came from the vendor's patch, not from anything the user did.
What actually lowers the risk
No small business can buy its way out of a targeted zero-click operation, but four controls shift the odds and cost little:
- Turn on automatic updates for phones, laptops and browsers, and treat an overdue OS patch as an incident. Every documented zero-click chain above died when the vendor shipped the fix.
- Keep high-risk people on the newest devices — staff on old, unpatched iOS or Android versions are the easiest targets in the building.
- Use vendor hardening modes for exposed roles. Apple's Lockdown Mode exists precisely for people likely to be targeted; executives handling sensitive deals or government work qualify.
- Assume the human layer still decides the outcome. In the overwhelmingly common case, the attacker needs your staff to cooperate — that is the part you can train.
Cyber Aware's security awareness training handles that last control: monthly lessons, simulated lures and one-click reporting so the reflex exists when the real message arrives, and human risk reporting shows which individuals are improving and which need follow-up.
Why this matters for Australian businesses
Zero-click headlines make owners feel that training is pointless — that a skilled attacker wins regardless. The data says otherwise. The breaches hitting Australian small businesses in 2026 overwhelmingly arrive through email, texts and compromised suppliers: spear phishing, social engineering and supply chain attacks, all of which need an employee to slip. Zero-click is the exception, not the pattern — and it is also the one attack category where the best available defence (patch fast) costs nothing at all.
FAQ
What is a zero-click attack in simple terms? An attack that infects a device without the user clicking, opening or approving anything — the exploit hides in data the device processes automatically.
Can a zero-click attack be prevented? Known ones are fixed by software updates; keeping devices patched and current closes every documented chain. Fully unknown exploits cannot be fully prevented by the user.
Do zero-click attacks work on iPhones? Yes — the most famous ones target iMessage and Apple's media processing. Apple ships fixes for each one it learns about, so an up-to-date iPhone is dramatically harder to hit.
How common are zero-click attacks? Rare, compared with phishing. They are expensive, one-shot tools aimed at specific people, which is why small businesses almost never encounter them.
Does security awareness training help against zero-click attacks? Not against the exploit itself — there is nothing for the user to spot. It helps against everything else, which is the bulk of the threat.
What should staff do if a device is suspected of spyware? Update the OS immediately, report it to IT rather than investigating alone, and treat accounts accessed from that device as compromised — rotate passwords and revoke sessions.
One last thing
Today, before anything else: check that automatic updates are on for every executive phone in the business. It is the single cheapest control against the most expensive attack class there is.