Zero-Click Exploits Explained: How Pegasus and State-Sponsored Spyware Infect Devices Without a Single Tap
Photo from Sendly Team / Unsplash
Back to ArticlesAI Security

Zero-Click Exploits Explained: How Pegasus and State-Sponsored Spyware Infect Devices Without a Single Tap

S
Sendly Threat Intelligence Unit • 2 min read

For years, cybersecurity awareness taught us a simple golden rule: 'Do not click suspicious links or download unknown email attachments.' But what happens when an attacker can compromise your smartphone without sending you a link, without displaying a notification, and without requiring any user interaction whatsoever? Welcome to the terrifying realm of Zero-Click exploits.

The Anatomy of a Zero-Click Attack

Zero-click exploits (most famously weaponized by commercial spyware suites like NSO Group's Pegasus and Cytrox's Predator) exploit automated background parsers. Modern messaging systems (iMessage, WhatsApp, MMS) automatically process incoming media packets before you even unlock your phone to preview them:

  • Media Pre-Rendering: Parsing image formats (GIF, WebP, TIFF, JPEG2000) to render thumbnails in your message preview.
  • Font Rendering Engines: Processing custom TrueType or OpenType embedded font glyphs.
  • PDF & Document Interpreters: Parsing complex vector graphics and embedded scripting layers.

Memory Corruption & Blastdoor Bypasses

By crafting an intentionally malformed image or PDF file (such as the famous FORCEDENTRY exploit targeting JBIG2 compression streams), the attacker triggers an integer overflow or heap buffer overflow in the low-level C++ parsing library.

The attacker tricks the CPU into executing arbitrary shellcode right inside the background parsing daemon, gaining kernel privilege escalation and turning on your camera, microphone, and GPS telemetry silently.

Defensive Posture: Sandboxing and Link Inspection

To defend against modern weaponized links and active payload exploits:

  1. Enable Lockdown Mode: On modern iOS and macOS devices, Lockdown Mode disables complex font parsing, image pre-rendering, and WebAssembly execution in unverified contexts.
  2. Inspect Unfamiliar Links in Sandboxes: When receiving unknown links across social channels, never paste them directly into your primary browser. Use tools like the Sendly Link Inspector to inspect redirect chains, headers, and certificates safely inside isolated disposable environments.
  3. Keep System Kernels Updated: Zero-click vulnerabilities are patched rapidly once discovered; delaying OS updates leaves known memory corruption holes open to threat actors.