In the Zero-Click scenario no user interaction is required. Meaning, the attacker doesn’t need to send phishing messages; the exploit just works silently in the background. Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it’s a weapon against which there is no defense.
—Google Project Zero, “A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution”
A Zero-Click attack is an exploit that requires no user interaction to operate – that is to say, no key-presses or mouse clicks. FORCEDENTRY, discovered in 2021, is an example of a zero-click attack.
—Wikipedia, “Exploit (computer security) – Zero-click”
A Zero-Click / Interactionless Attack is one that victims don’t need to click a link or grant a permission for the hack to move forward.
Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we’ve ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution Read More
The flaws are now fixed, but they speak to the growing concerns around interactionless attacks.
‘Zero-Click’ Zoom Vulnerabilities Could Have Exposed Calls Read More
Hacks that can play out without any user interaction may be more common than we realize, in part because they’re so difficult to detect.
Sneaky Zero-Click Attacks Are a Hidden Menace Read More
The newly disclosed campaign shows how little the company has done to curb abuses of its powerful surveillance tools.
NSO Group Spyware Targeted Dozens of Reporters in El Salvador Read More
ForcedEntry is “one of the most technically sophisticated exploits” Project Zero security researchers have ever seen.
Google Warns That NSO Hacking Is On Par With Elite Nation-State Spies Read More