No tap required: how zero-click and one-click attacks reach a phone

A vocabulary that matters

A zero-click attack runs without any action by the owner: a message arrives and is processed in the background. A one-click attack needs one action, such as opening a link, a file or a scanned code. A page visit, sometimes called a watering hole, sits between them: no tap on a suspicious thing, but a trip to a web page. A zero-day is a flaw exploited before its maker can fix it. The two ideas are independent; an old, patched flaw can be used with zero clicks against a phone that was never updated.

The categories are also contested at the edges. Apple’s September 2026 fix for a CoreGraphics flaw says only that processing a crafted file may lead to code execution, and does not say how the real attackers delivered it[S12]. Without the delivery route, "zero-click" or "one-click" would be a guess.

The anatomy of a chain

Entry is only the first step. Documented chains have the same later stages: code execution inside the component that handled the content, an escape from that component’s sandbox, a climb to higher privilege, and an implant (Figure 1). Google noted that multiple chains found in 2025 included three or more flaws[S7].

Four cases

A file named like an image (2021). Google Project Zero analyzed what it titled an NSO zero-click iMessage exploit. A file named as an image was in fact a PDF; the system identified it by content, and a flaw in the PDF parser’s image decoder gave code execution with no user interaction[S1].

A forensic mystery (2019 to 2023). Kaspersky found Operation Triangulation when suspicious network traffic from iPhones on its own corporate Wi-Fi was noticed. An iMessage attachment of about 242 KB triggered code execution without interaction, and the exploit and the message were deleted afterward. The oldest traces date to 2019, with activity still under way in June 2023. The strongest indicator was traces of a deprecated backup-related process, not the attachment[S3]. In September 2023 Citizen Lab described BLASTPASS, a zero-click chain on fully patched iOS 16.6 that used image attachments inside Apple’s wallet component, and attributed it to NSO Group; Citizen Lab and Apple believed Lockdown Mode blocked it[S2].

Logs, not a file (2025). Citizen Lab confirmed Paragon’s Graphite spyware on the iPhone of a European journalist, running iOS 18.2.1 and compromised between January and early February 2025. Apple said the zero-click flaw (CVE-2025-43200) was mitigated in iOS 18.3.1. The case was confirmed by device logs showing requests to a server matching a known fingerprint, until at least 12 April 2025, and by an attacker’s iMessage account, rather than by a malicious file[S4]. In August 2025 WhatsApp said a linked-device flaw chained with an Apple image flaw was used against a small number of people, reportedly dozens[S11].

Serbia (2025 to 2026). Citizen Lab, working with the SHARE Foundation, confirmed Pegasus on the iPhone of a member of a student protest movement, delivered by a zero-click iMessage exploit with indicators from December 2025 to January 2026; Apple fixed the flaw in iOS 18.4.1[S5]. A second report adds an infected phone belonging to a university official, and Apple threat notifications received by a former prosecutorial associate, which Citizen Lab treats as a targeting indicator and not proof of infection[S6]. SHARE has documented at least 14 notification cases. Citizen Lab does not name a government customer in the pages the Lab reviewed.

What hardening changed

Lockdown Mode, Apple’s optional strict setting, limits message attachment types, link previews and complex web features. Apple has said it is not aware of any successful mercenary spyware attack against a Lockdown Mode device[S10]. That is Apple’s statement, not an independent measurement.

Hardening raises the price. Google found chains of three or more flaws common in 2025 and counted 17, 9 and 15 mobile operating-system zero-days in 2023, 2024 and 2025; these counts are floors that are revised upward later [S7][S8].

How rare is it

Rarity is real. Apple says it has sent threat notifications to users in more than 150 countries since 2021, and that "the vast majority of users will never be targeted"[S9]. Its latest wave, on 13 August 2026, reached users in 110 countries, according to Apple’s statement to BleepingComputer[S10]. Neither figure is a prevalence rate: confirmed victims in public cases run from tens to low hundreds per campaign.

Where the label gets contested

Two 2026 episodes show why precision matters. In September an independent researcher reported a memory flaw in how an iPhone decodes one image format, reachable by an image sent over iMessage and processed in the background during indexing and thumbnailing. He says it reached memory corruption but not demonstrated code execution, that it was reported to Apple in May and fixed in iOS 27, and that there is no evidence of use in the wild. A public vulnerability entry scores it as needing user interaction, which conflicts with his zero-click description[S13]. It is one researcher’s account, and the Lab treats it as an example of the class, not as a confirmed case.

In October, Calif listed a "Signal 1-click" demonstration among its Hexacon announcements, with no technical detail, no software version and no advisory from Signal[S14]. A one-click label on an unreleased demonstration tells a reader nothing yet about what the click is or what it triggers.

Our assessment

First, the attachment is rarely the evidence. In Triangulation the file was deleted[S3]; in Graphite the confirming evidence was a log of requests[S4]. Examiners who look for the document will often find nothing.

Second, the same component, the one that previews content, keeps appearing. Chains keep entering through image, document and media handlers because those run automatically. Hardening of those handlers is the most meaningful trend to watch.

Third, no public source offers a median for how long a mobile compromise goes unnoticed. The honest answer is a range: from months in the Graphite case to years in Triangulation[S3][S4], in individual cases and not as an average.

What the Lab is watching

• Whether Apple or researchers disclose how the 2026 CoreGraphics flaw was delivered.
• New researcher or vendor reports that identify the entry route of a confirmed infection.
• Changes to what previews and attachment handlers do automatically.
• Updated counts in Google’s zero-day reviews.

What this means for examiners

Preserve the whole device state, not only the suspected message. Note the iOS version and the dates a log covers. Treat an Apple threat notification as a reason to examine, not a verdict.