The NewsRupt

The familiar cybersecurity warning is simple: do not click a suspicious link. That remains useful advice. But it does not describe every way a device can be compromised. In a zero-click attack, the dangerous step can happen inside software that processes an incoming message, attachment or call automatically. The owner may never open the message, answer the call or see a warning.

That changes the security conversation. Someone who followed sensible advice can still be targeted, and an absence of obvious mistakes does not establish that a device is safe. It also does not mean every unexpected call is an attack. The strongest public evidence concerns particular, sophisticated campaigns investigated by specialist researchers—not a finding that ordinary Americans are routinely being infected by mercenary spyware.

This explainer draws on Citizen Lab investigations, Google Project Zero technical analyses, Apple protection guidance and Amnesty International forensic research. The incidents discussed are historical examples. They explain the mechanism without claiming that an unverified new campaign is underway in October 2026.

WHAT ZERO-CLICK ACTUALLY MEANS

Zero-click describes what the victim has to do: nothing, in the relevant attack path. A device receives attacker-controlled input, processes it, and encounters a vulnerability. The attacker does not need to persuade the user to tap a link or install an application.

Zero-day describes something different. NIST defines a zero-day attack as one that exploits a previously unknown vulnerability. A zero-click attack can use a zero-day vulnerability, but the terms are not interchangeable. A vulnerability may become publicly known and receive a fix while devices that have not installed that fix remain exposed. The absence of a required click does not disappear just because a patch exists.

Spyware is different again. An exploit is the mechanism that takes advantage of a flaw; spyware is software or a capability used for surveillance after access is obtained. Depending on the implant and permissions available, surveillance may include messages, files, location or other sensitive information. Those capabilities should be established for a particular case, not assumed for every compromise.

A useful mental model is an entry mechanism, a chain of security failures and a surveillance payload. Sometimes those stages are discussed together as one attack. Separating them makes it easier to understand both the evidence and the defenses.

HOW A MESSAGE BECOMES AN ENTRY POINT

Modern phones do work before their owners interact with them. They decode images, prepare previews, handle call signaling and interpret structured attachments. That work makes communication feel immediate. It also exposes software to data supplied by people the recipient may not know.

Google Project Zero has examined image-processing paths reachable without user interaction. Its research highlights an important distinction: the vulnerable code can be an operating-system library used by a messaging application, rather than the messaging application itself. Calling an incident a messaging-app attack does not necessarily identify where the underlying programming flaw lives.

In a successful attack, malformed input may cause that processing code to behave in an unintended way. More advanced campaigns can combine vulnerabilities to move beyond the initially affected process or bypass other security boundaries. A single bug does not automatically produce unrestricted control of an entire phone. What the attacker can achieve depends on the full chain, the device version and the protections in place.

This is why the attack does not have to resemble a phishing message. Its persuasive wording may be irrelevant. The malicious content is directed at software that handles the message, not at a person deciding whether the sender sounds trustworthy.

THREE DOCUMENTED CASES THAT EXPLAIN THE RISK

The 2019 WhatsApp case demonstrated that a call-related processing path could be used without the target interacting with malicious code. Citizen Lab reported the vulnerability and associated spyware activity in May 2019, and WhatsApp issued a security update. The lesson is not that today's WhatsApp calls are inherently unsafe. It is that software handling an incoming communication can become an attack surface before a person chooses to answer.

FORCEDENTRY provided another example in September 2021. Citizen Lab found the zero-click iMessage exploit while examining the phone of a Saudi activist infected with Pegasus spyware. Researchers attributed its use to NSO Group and reported that Apple addressed the associated vulnerability, CVE-2021-30860, in a security update on September 13, 2021.

Google Project Zero's subsequent analysis explained that the attack used a PDF disguised as a GIF and abused image-processing functionality. The detail matters because it shows why the visible file label is not a complete description of what the software actually processes. The broader lesson is about complex parsing code and security boundaries, not about distrusting every image someone sends.

BLASTPASS was a separate exploit chain documented by Citizen Lab on September 7, 2023. Researchers examined a device belonging to an employee of a Washington, D.C.-based civil-society organization with international offices. They reported that the chain could compromise an iPhone running iOS 16.6—the latest version at the time—without interaction from the victim.

According to Citizen Lab, BLASTPASS involved malicious images in PassKit attachments sent through iMessage and was used to deliver Pegasus. Apple issued fixes associated with CVE-2023-41064 and CVE-2023-41061. Citizen Lab also reported that Apple's security team confirmed Lockdown Mode blocked that particular attack.

These findings are specific: investigated devices, identified chains and fixes released on particular dates. They do not establish that those old chains compromise fully updated devices today, or that every suspicious communication delivers spyware. They do establish that a device can be targeted even when its owner never makes the click normally associated with an infection.

WHY ENCRYPTED MESSAGING DOES NOT SETTLE THE QUESTION

End-to-end encryption protects message contents in transit between communicating endpoints. It does not mean every piece of code running on those endpoints is free of vulnerabilities. A phone still has to receive, decrypt and process a message so its owner can use it.

If an attacker gains sufficient access to the device itself, information may become accessible at an endpoint rather than through interception of encrypted network traffic. That is a different problem from breaking the encryption protocol. Describing all spyware cases as encryption failures confuses two separate layers of security.

The practical conclusion is to keep using reputable encrypted services while also keeping the device and its applications updated. Abandoning encryption because endpoint attacks exist would remove a useful protection without fixing the endpoint problem.

WHO SHOULD BE MOST CONCERNED?

Apple describes mercenary spyware attacks as individually targeted, exceptionally costly and complex. Its guidance says the vast majority of users will never be targeted by such attacks. That is important context for a subject that easily turns into alarming headlines.

Journalists, human-rights defenders, political figures and others working on sensitive matters have appeared in documented investigations. For a U.S. organization, the relevant question is whether an employee's work, access or international relationships could make targeted surveillance valuable—not whether every employee owns a particular brand of phone.

High cost does not make the consequences small. A compromise of one person's device can expose contacts, reporting sources, confidential discussions or information about colleagues. For newsrooms, civil-society organizations and sensitive professional teams, protecting a few high-risk people can therefore have a wider institutional benefit.

This is a risk-assessment issue, not a reason to accuse a government, company or acquaintance based on a missed call. Attribution requires evidence. The public investigations cited here do not provide a reliable probability that any individual reader will be attacked.

WHAT ACTUALLY HELPS

First, install operating-system and application security updates promptly. Keep computers, tablets and watches updated as well as phones. Updates close known vulnerabilities; they cannot promise protection against every flaw that has not yet been discovered. Nevertheless, leaving a documented weakness open is a preventable risk.

Second, people with an elevated threat profile should consider Apple's Lockdown Mode on supported devices. Apple describes it as an optional, extreme protection that reduces the available attack surface by restricting certain features. Some message attachments, web technologies and incoming communication behaviors work differently. Those restrictions are the point, not an incidental inconvenience.

Lockdown Mode is not an antivirus scan, a certification that a device is clean or a guarantee of immunity. The BLASTPASS finding is evidence that it blocked one documented chain. It should not be stretched into a claim that it defeats every future zero-click attack. Readers using other platforms should check the current security options and update guidance for their own device rather than assume Apple's feature exists everywhere.

Third, keep strong, unique account credentials and use passkeys or appropriate multifactor authentication where available. These measures address account attacks, which can expose sensitive information without a device exploit. They are worthwhile, but a stronger password does not repair a vulnerable image decoder. Different defenses solve different problems.

Fourth, do not treat a commercial scanner's clean result as conclusive proof that sophisticated spyware is absent. Specialist forensic work may require device records, relevant indicators and careful interpretation. Normal battery life, a lack of strange pop-ups and an unfamiliar process name are not reliable substitutes for that work.

IF YOU RECEIVE AN APPLE THREAT NOTIFICATION

Take it seriously and verify it through Apple's official account website by navigating there yourself. Apple's guidance explains that a threat notification is displayed after signing in at account.apple.com. Do not rely on a link supplied by a stranger offering to confirm the warning.

Apple says its threat notifications are high-confidence alerts that a user has been individually targeted by mercenary spyware. They are not a universal detection service, and Apple acknowledges that its investigations cannot achieve absolute certainty. A notification is a reason to act; not receiving one is not proof that no attack occurred.

Apple recommends expert assistance and points recipients to Access Now's Digital Security Helpline. For an employee handling sensitive work, an organization's security team should also be involved through a trusted channel. Avoid sending confidential device information to unsolicited accounts claiming they can remove Pegasus.

If compromise is reasonably suspected, preserve the warning and seek qualified advice before wiping the device, installing untrusted cleanup tools or making changes that could destroy evidence. If continued exposure creates an immediate safety risk, obtaining help from a separate trusted device may be more important than preserving every trace. Response should account for both personal safety and investigative needs.

WHAT ORGANIZATIONS SHOULD DO DIFFERENTLY

A zero-click threat exposes the limits of a security program built entirely around teaching staff not to click. Training remains useful for phishing and account fraud, but it cannot prevent processing that happens automatically.

A better program identifies high-risk roles, maintains supported devices, makes security updates easy to install and establishes a confidential way to report vendor alerts. It also plans for specialist forensic assistance before an incident occurs. Staff should know whom to contact without having to research unfamiliar security vendors while frightened.

Organizations should distinguish suspected compromise from confirmed compromise and confirmed compromise from attribution. They should also avoid blaming a targeted employee for failing to recognize a message that the attack never required them to open. The relevant questions are what evidence exists, what information might be exposed and what protective action is justified.

WHAT WE DO NOT KNOW YET

Public reporting reveals only part of the mercenary spyware market. Investigations can establish particular incidents without measuring the total number of successful attacks. This article does not calculate U.S. infection rates, identify a new October 2026 campaign or claim to have tested any reader's device.

Forensic evidence has limits. Amnesty's methodology explains how researchers interpret traces associated with Pegasus; a known indicator must be assessed in context. Absence of a known trace does not prove absence of compromise, and an isolated suspicious artifact does not establish a successful infection by itself.

The defensible conclusion is narrower than either panic or reassurance. Zero-click spyware is a documented threat. Timely updates, reduced attack surface and expert incident response provide meaningful protections. No single setting or habit can turn a complex device into a guarantee.

EDITORIAL NOTE AND SOURCES

By Rajesh Adhikesavan for TheNewsRupt. This is a document-based explainer, not a hands-on spyware test or forensic diagnosis. AI assisted research and drafting. Incident descriptions are attributed to the researchers who published them; the practical conclusions are editorial analysis. Historical examples are labeled with their dates rather than presented as current breaking news.

Citizen Lab, May 2019 WhatsApp voice-call investigation: https://citizenlab.ca/whatsapp-voice-calls-used-to-inject-nso-group-spyware-in-phones/

Citizen Lab, FORCEDENTRY, September 13, 2021: https://citizenlab.ca/research/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/

Google Project Zero, FORCEDENTRY technical analysis, December 2021: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html

Citizen Lab, BLASTPASS, September 7, 2023: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/

Apple, threat notifications and mercenary spyware guidance: https://support.apple.com/en-us/102174

Apple, Lockdown Mode protections and restrictions: https://support.apple.com/en-us/105120

Amnesty International, Pegasus forensic methodology, July 2021: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/

NIST, zero-day attack definition: https://csrc.nist.gov/glossary/term/zero_day_attack

Amnesty Security Lab, technical glossary: https://securitylab.amnesty.org/glossary/