Zero-click

Security incidents tagged Zero-click. Newest first.

0 Zero-click incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Incidents: 3
Live: 0
Patched: 3
Days without an incident: 1137; Longest quiet run: 1030 days (Dec 28–Oct 22)

Show 3 older incidents

Sep 7HighBLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)Patched
Apple iOS, iPadOS, macOS and watchOS Patched
Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.
Open incident →CVE-2023-41064 · CVE-2023-41061

Jun 1HighOperation Triangulation: zero-click iMessage spyware on Kaspersky's iPhonesPatched
Apple iOS (and other Apple OSes sharing the bugs) Patched
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.
Open incident →CVE-2023-32434 · CVE-2023-32435 · CVE-2023-38606

Mar 14CriticalOutlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)Patched
Microsoft Outlook for Windows Patched
A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.
Open incident →CVE-2023-23397