Zero-Click Exploits Guide: Exposure, Patching and Protecting High-Risk Devices

A zero-click exploit compromises a device or service without the victim doing anything, so the usual human safeguards of suspicion, training and not clicking simply do not apply. On phones, zero-click chains arrive through messages, images and calls that the operating system or a messaging app processes automatically. The same idea now appears in AI assistants and agents that read untrusted email or records on a user's behalf, and in internet-facing services that can be exploited without credentials. This guide explains where zero-click exposure lives, how to reduce it, how to patch at the speed it demands and how to detect it. It is written for vulnerability management, mobile and security operations teams, and for anyone protecting high-risk users.

Key takeaways

• Attack surface, not behaviour, is the variable. Any component that parses untrusted input automatically, such as message previews, image decoders or an AI agent's inbox, is a potential zero-click entry point.
• Patch latency is the main control you own. Documented mobile chains were fixed by vendors within days of discovery; exposure after disclosure depends on how fast your devices update.
• Reduce what is parsed. Apple Lockdown Mode and Android Advanced Protection switch off much of the automatic processing that zero-click chains rely on.
• AI agents created a new zero-click class. Prompt injection hidden in content that an assistant reads on its own can lead to data exfiltration without any user action, as the EchoLeak and SalesBleed cases showed.
• Detection is mostly external. Vendor threat notifications, published indicators and CISA KEV additions are the signals; build a process that acts on them within hours.

How the attack works

"Zero-click" describes the interaction model, not a specific flaw. It covers three broad families, described here at a defensive level only.

Mobile chains usually combine several vulnerabilities: one to gain code execution in the parsing component, one or more to escape the app sandbox and reach the kernel, and often one to defeat platform mitigations. Google Threat Intelligence Group (GTIG) noted, as reported in March 2026, that commercial vendors increasingly build chains of three or more vulnerabilities. Every link must hold for the attack to succeed, which is why removing a parser or patching any single link breaks the chain.

The economics matter for defenders: a working iOS or Android zero-click chain is expensive and burned once discovered, so it is used against a small number of chosen targets. For most staff the risk arrives later, when the patched flaw becomes known and less capable attackers try it against slow-to-update devices.

Where it shows up

GTIG tracked 90 zero-days exploited in the wild in 2025, up from 78 in 2024, and counted 15 mobile zero-days in 2025 against 9 the year before. The cases below are all in the CISA Known Exploited Vulnerabilities (KEV) catalogue unless stated.

• Mobile: the highest-profile zero-click activity, tied to commercial spyware. See the Mobile Malware Guide for the wider mobile threat picture.
• AI assistants and agents: the EchoLeak case showed how a crafted email could make Microsoft 365 Copilot leak company data with no user click, and SalesBleed showed poisoned web-to-lead records turning Salesforce Agentforce agents into zero-click data thieves.
• Edge devices: unauthenticated flaws in VPN and gateway appliances behave as zero-click for the organisation. The Ivanti Connect Secure exploitation exposed credentials, service accounts and sessions. See the Edge Device Security Guide.

Impact

• Silent full compromise: Citizen Lab assessed that the Graphite infection would not have been visible to the target, so data loss can continue for weeks.
• Encryption bypass: once the endpoint is controlled, end-to-end encrypted messages are read after decryption.
• Identity theft at scale: session tokens, OAuth grants and agent credentials on the compromised device or service become the attacker's.
• Agent misuse: in AI cases the agent's own permissions define the blast radius, including mail, files and CRM data it can reach.
• Wide second-wave exposure: after disclosure, every unpatched device carrying the flaw is at risk from copycat exploitation.

Detection

Metrics that show the programme works:

• Median hours from KEV listing to 95 percent of managed mobile devices on the fixed version.
• Percentage of high-risk users with Lockdown Mode or Advanced Protection enabled.
• Percentage of devices on the latest major OS release (older majors receive fewer fixes).
• Number of AI agents with untrusted-input sources that have an approved data egress allowlist.
• Time from user threat notification to forensic collection.

Feed these into the Vulnerability Management Guide reporting cycle.

Prevention and hardening

Choosing controls by exposure

Small versus large organisations: a small organisation can rely on automatic updates plus a forced minimum OS version in its mobile management tool and Lockdown Mode for two or three people. A large one needs patch rings, a measured compliance window, conditional access that blocks out-of-date devices from corporate apps and a register of hardening exceptions. See the Mobile Device Security Guide and the Patch Management Guide.

Implementation steps

1. Inventory parsers and exposure: list mobile OS versions, messaging apps, browsers, AI agents with external inputs and internet-facing appliances.
2. Set emergency patch rules: a KEV listing or vendor in-the-wild note for any of them triggers a 72-hour fleet target and a 24-hour target for high-risk users.
3. Enforce through access: conditional access denies corporate data to devices below the fixed version after the grace period.
4. Pilot hardening modes: enable Lockdown Mode or Advanced Protection for volunteers in the high-risk group for two weeks, record breakage, approve narrow exclusions only for trusted sites or apps.
5. Constrain AI agents: treat inbound email, forms and records as untrusted, separate them from instructions, require approval for outbound sends and restrict destinations.
6. Test response: run a tabletop where a user receives a threat notification and confirm evidence collection works.
7. Roll back if needed: hardening modes can be turned off in settings with a restart; document the reason and a re-enable date. Patch rollbacks on mobile are generally not possible, so stage updates through a pilot ring of a few hours, not days.

Where identity fits

Zero-click compromise steals what the device or agent holds: sessions, refresh tokens, API keys and service credentials. After any suspected case, revoke and reissue those credentials from a clean system and scope agent identities to the minimum data they need. See the Agentic AI Security Guide.

Lessons from incidents

• Patched at the time is not enough: the Graphite and WhatsApp chains worked against devices that were up to date until the fix shipped, so hardening modes matter for the people most likely to be targeted first.
• Third-party apps are part of the OS attack surface: the August 2025 chain combined a WhatsApp flaw with an Apple flaw; patch policy must cover messaging apps, not just the OS.
• Android vendor patches lag: LANDFALL samples appeared from July 2024 and the fix came in April 2025, and devices that miss vendor updates stay exposed after that.
• AI agents inherit the zero-click problem: EchoLeak and SalesBleed show that any agent reading untrusted content needs the same isolation thinking as a message parser.
• Edge appliances are zero-click for the enterprise: the Ivanti case shows credentials and service accounts on the box must be rotated after patching, not only the firmware updated.

Framework mapping

Practitioner checklist

• Subscribe to the CISA KEV feed and vendor security notes for mobile OS, messaging apps and browsers.
• Set a 72-hour fleet and 24-hour high-risk target for in-the-wild mobile fixes, and measure it.
• Block corporate access from devices below the minimum fixed OS and app version.
• Enable Lockdown Mode or Android Advanced Protection for named high-risk users after a pilot.
• Include WhatsApp and other messaging apps in patch compliance reporting.
• Inventory AI agents that read external content and apply egress allowlists and human approval for outbound actions.
• Remove internet exposure of appliance management interfaces and rotate their secrets after emergency patches.
• Publish a threat notification procedure: verify in the account portal, preserve, escalate.

Standards and references

• CISA: Known Exploited Vulnerabilities Catalog
• Apple: About Lockdown Mode
• Google: Android Advanced Protection
• MITRE ATT&CK: Exploitation for Initial Access (Mobile)
• Citizen Lab: BLASTPASS, NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild
• Citizen Lab: Graphite Caught, First Forensic Confirmation of Paragon's iOS Mercenary Spyware
• Palo Alto Networks Unit 42: LANDFALL, Commercial-Grade Android Spyware
• The Record: Google says 90 zero-days exploited in 2025

Related NHI Mgmt Group resources: Zero-Day and Exploited Vulnerabilities Guide · Mobile Device Security Guide · Prompt Injection Guide · Vulnerability Management Guide