Zero-click attacks

What you'll get from this chapter: What a zero-click attack is, why it is rare for ordinary people, and the simple habit that is the actual fix.

Part III: Smartphone Survival Kit · Chapter 7 of 14

Last reviewed: October 18, 2026

A zero-click attack infects a device without a tap. These are rare, expensive, and aimed at specific people, not at everyone with a phone.

A zero-click exploit is a software flaw so severe that a message or a call can install spyware before you open anything. Tools in this class, such as commercial spyware sold to governments, have been used against journalists, activists, and political staff. Apple, Google, and WhatsApp release emergency updates when these flaws are found, sometimes after attackers have already used them.

For most people the practical defense is boring: install system updates the day they appear, and do not assume a strange glitch is spyware. For someone who has a reason to believe they are individually targeted, the next step is a current backup, a factory reset, and a specialist, not a random “cleaner” application from an advertisement.

Zero-click attacks are rare. A friendly stranger who texts the wrong number is not. The next chapter covers wrong-number texts that turn into relationships.