A zero-click attack hacks your phone without you tapping, opening or approving anything.

Most hacking needs a mistake from the victim: a link they tap, a file they open, a password they type. A zero-click attack skips that step. It targets a flaw in an app that automatically processes incoming data, such as a message, so the phone can be infected before the owner even sees it.

This makes zero-click exploits rare and dangerous. They need no user interaction to succeed, and they leave almost no visible traces, so victims often never know. In December 2020, researchers showed what that looks like in practice, when dozens of Al Jazeera journalists were found to have been hacked this way.

In July and August 2020, spyware infected 36 personal phones belonging to journalists, producers, anchors and executives at Al Jazeera. A journalist at London-based Al Araby TV was also hacked.

The finding came from Citizen Lab, a research group at the University of Toronto. It began when Tamer Almisshal, an investigative journalist at Al Jazeera who hosts a show on politically sensitive topics, suspected his phone was compromised and contacted the researchers.

Citizen Lab traced the infections to an exploit chain it named KISMET. It appears to involve an invisible zero-click exploit in iMessage, Apple’s messaging app. At the time, KISMET was a zero-day, meaning Apple did not yet know the flaw existed. It worked against iOS 13.5.1 and could hack the then-latest iPhone 11.

The journalists did not have to click a bad link. Once infected, a phone could be turned into a surveillance device, with access to its camera and location. Citizen Lab also believes the same or a related exploit was used successfully between October and December 2019.

The spyware was Pegasus, made by NSO Group, an Israeli company that sells it to governments. Citizen Lab found four Pegasus operators behind the Al Jazeera hacks. It attributed one to Saudi Arabia and another to the United Arab Emirates.

The motive is plausible: Al Jazeera is based in Qatar and often critical of regional powers, and its reporting has drawn anger from both countries in the past.

The public evidence therefore points to Saudi and UAE operators using an Israeli company’s product. It does not show the Israeli government itself carrying out this hack. Claims that go further than that are not supported by the Citizen Lab report.

NSO has a wider record. Citizen Lab had earlier shown Pegasus on the phone of Omar Abdulaziz, a Saudi dissident close to the murdered journalist Jamal Khashoggi. Pegasus has also been used by authoritarian governments to spy on lawyers, activists, dissidents and journalists around the world. NSO has denied such allegations in the past.

Citizen Lab warned that the industry’s shift toward zero-click attacks makes abuse more likely to go undetected. It also noted that the Al Jazeera cases may be only a fraction of the total, since nearly all iPhones before iOS 14 appear to have been vulnerable to this exploit.

The flaw has a fix. Citizen Lab does not believe KISMET works against iOS 14 and above, which added new security protections. For ordinary users, the practical lesson is to install system updates promptly, because updates close the holes that exploits like this depend on. Journalists and activists facing state-level targets need more than that, but updating is the first defense everyone can use.