Zero-Click Attack
A type of cyberattack that requires no user interaction to trigger. An attacker need only send a specially crafted message to a target device to exploit a vulnerability and deploy malicious code. It is considered one of the most dangerous techniques used in targeted attacks.
Core Facts
Both vulnerabilities are of the zero-click attack type, meaning attackers can execute arbitrary code in the user's running environment and steal sensitive credentials such as API keys without the victim clicking any link or downloading any file.
Zero-click attacks typically combine multiple stages: a parsing vulnerability in a rendering engine, a system-level privilege escalation vulnerability, and a silent installation mechanism used for persistence.
Timeline (last 90 days)
Researchers found the first technical evidence of a zero-click attack being carried out through online ads.
A zero-click attack means the entire attack requires no target to click a link, download an attachment, or authorize any permission.
Zero-click attacks typically combine multiple stages: a parsing vulnerability in a rendering engine, a system-level privilege escalation vulnerability, and a silent installation mechanism used for persistence.
Zero-click attacks bypass the security advice of not clicking suspicious links, and protection depends entirely on vulnerability fixes at the endpoint and browser levels.
Practical means of defending against zero-click attacks include: promptly updating browsers and systems, restricting third-party scripts, and using isolated devices for sensitive groups.
The most fundamental difference between zero-click attacks and traditional click-based attacks is that the trigger does not depend on any user decision, so social engineering defenses are completely ineffective against them.
Both vulnerabilities are of the zero-click attack type, meaning attackers can execute arbitrary code in the user's running environment and steal sensitive credentials such as API keys without the victim clicking any link or downloading any file.
All Facts (7)
Both vulnerabilities are of the zero-click attack type, meaning attackers can execute arbitrary code in the user's running environment and steal sensitive credentials such as API keys without the victim clicking any link or downloading any file.
65%Partially VerifiedZero-click attacks typically combine multiple stages: a parsing vulnerability in a rendering engine, a system-level privilege escalation vulnerability, and a silent installation mechanism used for persistence.
65%UnverifiedResearchers found the first technical evidence of a zero-click attack being carried out through online ads.
50%UnverifiedA zero-click attack means the entire attack requires no target to click a link, download an attachment, or authorize any permission.
50%UnverifiedZero-click attacks bypass the security advice of not clicking suspicious links, and protection depends entirely on vulnerability fixes at the endpoint and browser levels.
50%UnverifiedPractical means of defending against zero-click attacks include: promptly updating browsers and systems, restricting third-party scripts, and using isolated devices for sensitive groups.
50%UnverifiedThe most fundamental difference between zero-click attacks and traditional click-based attacks is that the trigger does not depend on any user decision, so social engineering defenses are completely ineffective against them.
50%