The most dangerous compromise is the one that never asks for your help. You do not tap a link. You do not open an attachment. You do not type a password into a lookalike login page. Your iPhone simply receives a message, and moments later it belongs to someone else. This is the reality of the zero-click exploit, and over the past several years it has moved from theoretical nightmare to thoroughly documented fact.

Mercenary spyware vendors and nation-state threat actors have repeatedly turned Apple’s iMessage—one of the most-used communication channels on the planet—into a silent intrusion vector. Campaigns like NSO Group’s Pegasus, the BLASTPASS exploit chain, and Kaspersky’s Operation Triangulation prove that a fully patched, top-of-the-line iPhone can be breached without the target doing anything at all. For journalists, dissidents, executives, attorneys, and government officials, that changes the entire threat calculus.

This article walks through how zero-click attacks work, examines three real, well-attributed campaigns, and lays out the defensive playbook—prompt patching, Apple’s Lockdown Mode, threat notifications, and forensic acquisition—that Honeybadger Solutions uses to help high-risk clients detect and respond to mercenary spyware.

What “Zero-Click” Really Means

Most people picture hacking as social engineering: a phishing email, a malicious download, a poisoned USB drive. Those “one-click” or “zero-day plus a click” attacks still dominate the broader threat landscape. A zero-click exploit is a different and more alarming animal. It requires no user interaction whatsoever—no tap, no preview, no consent.

The mechanics come down to attack surface. Modern smartphones automatically process an enormous amount of untrusted data before a human ever sees it. When a message arrives, the operating system parses attachments to generate previews, render images, decode fonts, and display rich content. Each of those parsing routines is code, and code has bugs. A memory-corruption vulnerability—a buffer overflow, an integer overflow, a type confusion—in one of these background parsers can be triggered simply by delivering a maliciously crafted file. The exploit fires during automatic processing, before any notification is even shown.

Because messaging apps like iMessage receive content from anyone who knows your number or Apple ID, they present an especially rich, remotely reachable attack surface. A threat actor chains several vulnerabilities together—an exploit chain—to move from that initial parsing bug to full code execution, then to kernel-level privileges, and finally to a persistent or memory-resident implant. The victim sees nothing. That silence is the entire point: it defeats security awareness training, defeats “don’t click suspicious links” advice, and leaves almost no visible trace.

Pegasus and FORCEDENTRY: The Exploit That Rewrote the Rules

No name is more associated with mercenary spyware than Pegasus, developed by the Israeli firm NSO Group and sold to government clients around the world. Pegasus has been documented on the phones of journalists, human rights defenders, and political figures across multiple continents, and it became the archetype of the commercial spyware industry.

In September 2021, researchers at the University of Toronto’s Citizen Lab captured and analyzed a Pegasus zero-click exploit they named FORCEDENTRY. It was assigned CVE-2021-30860. According to Citizen Lab’s analysis, the exploit abused an integer overflow vulnerability in Apple’s CoreGraphics/ImageIO image-rendering pipeline. Apple described the flaw plainly: “processing a maliciously crafted PDF may lead to arbitrary code execution.” In practice, a file disguised as a GIF but containing a malformed PDF was delivered over iMessage and triggered the bug during automatic processing.

FORCEDENTRY was remarkable for what it defeated. It reportedly circumvented “BlastDoor,” a sandbox Apple had introduced specifically to harden iMessage against exactly this class of attack. Citizen Lab tied the exploit to Pegasus through forensic artifacts on victim devices—including a distinctive incomplete-deletion pattern in the phone’s DataUsage.sqlite file and process names previously observed in earlier NSO operations. Apple patched the vulnerability in iOS 14.8 and companion updates released on September 13, 2021, and later filed suit against NSO Group.

FORCEDENTRY mattered because it proved, with captured evidence rather than speculation, that a mercenary spyware vendor could breach a current iPhone with zero user interaction. It set the template for everything that followed.

BLASTPASS: Pegasus Returns Through the Wallet

Two years later, in September 2023, Citizen Lab discovered that Pegasus was still finding its way onto fully updated iPhones. Investigating the device of an employee at a Washington, D.C.–based civil society organization, researchers uncovered an active zero-click exploit chain they named BLASTPASS.

Apple issued two CVEs tied to the chain:

CVE-2023-41064 — a buffer-overflow vulnerability in ImageIO. Apple’s advisory states that “processing a maliciously crafted image may lead to arbitrary code execution.”
CVE-2023-41061 — a validation issue in Wallet, where “a maliciously crafted attachment may result in arbitrary code execution.”

Citizen Lab reported that the chain “involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim.” In other words, the attack rode in on a Wallet/PassKit pass, slipping malformed image data past Apple’s defenses to achieve code execution—again, with no interaction from the target. Citizen Lab attributed the compromise to NSO Group’s Pegasus spyware.

The vulnerabilities were serious enough that both were actively exploited in the wild against a device running what was then the current iOS. Apple shipped emergency fixes in iOS 16.6.1, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2023-41064 and CVE-2023-41061 to its Known Exploited Vulnerabilities (KEV) Catalog on September 11, 2023. BLASTPASS underscored a hard truth: patching FORCEDENTRY did not end the threat. The commercial spyware industry simply moved to the next weak spot in the attack surface.

Operation Triangulation: A Four-Vulnerability Masterpiece

If FORCEDENTRY and BLASTPASS showed what a single vendor could do, Operation Triangulation revealed the sheer depth a determined threat actor can reach. Discovered by Kaspersky when researchers noticed suspicious traffic on their own corporate Wi-Fi, the campaign targeted iPhones—including devices belonging to Kaspersky’s own staff—over a multi-year period.

The infection began the now-familiar way: an iMessage attachment arrived, triggered a vulnerability with no user interaction, and executed code. But what Kaspersky reconstructed was one of the most sophisticated exploit chains ever publicly documented against iOS, stitching together four separate zero-day vulnerabilities:

CVE-2023-41990 — a remote-code-execution flaw in font processing. Kaspersky reported the attackers exploited “the remote code execution vulnerability in the undocumented, Apple-only ADJUST TrueType font instruction,” giving them their initial foothold from the malicious iMessage attachment.
CVE-2023-32434 — an integer overflow in the XNU kernel’s memory-mapping syscalls (mach_make_memory_entry and vm_map). Kaspersky described it as granting “read/write access to the entire physical memory of the device at user level.”
CVE-2023-32435 — a WebKit/Safari vulnerability used in a second stage to execute shellcode that launched the kernel-level exploitation code.
CVE-2023-38606 — perhaps the most extraordinary link in the chain. The attackers used undocumented hardware memory-mapped I/O (MMIO) registers in Apple-designed SoCs to bypass the device’s hardware-based memory protection (the Page Protection Layer). This was a hardware feature so obscure that its existence and purpose were not publicly known.

The final payload was a spyware implant Kaspersky named TriangleDB. Its design reflects the same stealth-first philosophy as the exploit chain. TriangleDB runs only in memory after the attackers gain root through the kernel exploit, which means “all traces of the implant are lost when the device gets rebooted.” It carried roughly two dozen commands supporting file exfiltration, process manipulation, precise location tracking, and credential theft—including dumping keychain items such as generic passwords, internet passwords, keys, and certificates. To limit exposure, the implant was designed to auto-uninstall after 30 days unless operators actively extended its lifespan. Apple patched the vulnerabilities in a series of iOS updates across 2023, and several of the CVEs were added to the CISA KEV Catalog.

Operation Triangulation is a case study in why zero-click threats are so hard to counter. The chain reached from a font parser all the way down to undocumented silicon, and the implant vanished on reboot. Only an organization with deep forensic capability and a bit of luck ever caught it.

Why These Campaigns Should Worry More Than the Ultra-Elite

It is tempting to file mercenary spyware under “not my problem”—the tools cost a fortune, and operators aim them at high-value targets, not the average user. That framing is dangerously incomplete.

First, the target profile is broader than most assume. Documented victims include journalists, human rights workers, lawyers, business executives, dissidents, and government personnel—precisely the kinds of people who work with, advise, or employ ordinary organizations. If your firm serves a client who is a target, your systems and communications become part of that person’s attack surface.

Second, exploit techniques trickle downward. A method pioneered by a well-funded threat actor gets studied, adapted, and eventually recycled by lower-tier criminals. The specific bugs get patched; the underlying playbook—abuse an automatic parser, chain to the kernel, deploy a stealthy implant—endures.

Third, these campaigns exposed structural weaknesses in the mobile attack surface itself. Every automatically processed attachment type is a candidate for the next zero-click vulnerability. That is why defense cannot rest on any single patched CVE.

Detection and Defense: The Practical Playbook

There is genuine good news here. The same discipline that stops ordinary malware also raises the cost of a zero-click intrusion dramatically, and the highest-risk individuals have purpose-built protections available today.

Patch Relentlessly and Promptly

Every campaign above was ultimately shut down by a software update. FORCEDENTRY fell to iOS 14.8; BLASTPASS to iOS 16.6.1; Operation Triangulation to a run of 2023 updates. The single most effective defensive habit is installing security updates the moment they ship. Enable automatic updates, and treat Apple’s Rapid Security Responses as urgent rather than optional. A patched device is immune to the specific exploit chains that were burned to discover these bugs. The window of exposure is the gap between disclosure and installation—close it fast.

Cross-reference the vulnerabilities that matter with the CISA Known Exploited Vulnerabilities Catalog, which flags CVEs confirmed to be exploited in the wild. All of the BLASTPASS CVEs and several Operation Triangulation CVEs appear there. For organizations, KEV should drive patch prioritization; for individuals, it is a reliable signal that a given update fixes something actively dangerous.

Enable Lockdown Mode for High-Risk Individuals

Apple introduced Lockdown Mode specifically to counter mercenary spyware. It is an optional, extreme-protection setting that sharply reduces the attack surface: it blocks most message attachment types, disables link previews, restricts certain web technologies, blocks incoming FaceTime calls and invitations from unknown contacts, and limits wired connections. Many of the exact mechanisms these zero-click chains abused—automatic attachment and image processing over iMessage—are curtailed or disabled outright.

Lockdown Mode is not for everyone; it noticeably degrades convenience. But for journalists, executives, attorneys handling sensitive matters, activists, and anyone with reason to believe they may be individually targeted, it is one of the strongest single settings available. CISA’s own Mobile Communications Best Practice Guidance urges highly targeted individuals to adopt hardened configurations on their devices, and enabling Lockdown Mode is a core recommendation for iPhone users in that population.

Heed Apple Threat Notifications

Apple sends threat notifications to users it believes have been individually targeted by state-sponsored or mercenary spyware attacks. These alerts appear at the top of the user’s Apple Account page and are delivered by email and iMessage. They are rare, deliberately high-signal, and should never be dismissed. If you or a client receives one, treat it as a confirmed incident: preserve the device, avoid altering it, and engage forensic help immediately. Apple also directs at-risk users toward Lockdown Mode and organizations like Access Now’s Digital Security Helpline.

Forensic Acquisition and Spyware Detection

Because implants like TriangleDB can live only in memory and self-destruct—or because a reboot can wipe evidence—how you handle a suspect device matters enormously. Powering a phone off or letting it update can destroy exactly the artifacts an investigator needs.

Sound mobile forensics starts with preservation: minimize interaction with the device, keep it charged and isolated where possible, and capture a forensic image before making changes. Investigators then examine known indicators of compromise—anomalous entries in databases like DataUsage.sqlite, suspicious process names, unexpected network destinations, and configuration artifacts—the same categories of evidence that let Citizen Lab and Kaspersky attribute these campaigns. Apple’s sysdiagnose logs and full logical or file-system acquisitions can surface traces that never appear on the screen. This is specialized work; a well-meaning but improvised examination can permanently destroy the evidence that proves an intrusion.

Reduce the Attack Surface You Control

Beyond the specialized tools, ordinary hygiene still helps: reboot high-risk devices regularly (memory-only implants do not survive a reboot), limit who can reach you over iMessage and FaceTime, keep the number of installed apps and background services lean, and separate sensitive communications onto dedicated, hardened devices where the stakes justify it. None of this guarantees immunity against a determined, well-funded threat actor—but every reduction in attack surface raises the cost and lowers the odds of a successful breach.

Conclusion: Silence Is Not Safety

Zero-click exploits invert the intuition that keeps most people safe. There is no suspicious link to avoid, no bad decision to catch, no obvious moment of compromise. Pegasus, BLASTPASS, and Operation Triangulation each proved that a current, fully patched iPhone can be breached through nothing more than a message it received on its own—and that the resulting spyware can read messages, track location, harvest credentials, and then quietly disappear.

The defenses are real and they work: patch the instant updates arrive, use the CISA KEV Catalog to prioritize what matters, enable Lockdown Mode for anyone genuinely at risk, take Apple threat notifications seriously, and preserve devices properly when compromise is suspected. Discipline raises the cost of intrusion enough that most threat actors move on.

For the moments when the stakes are higher—when you suspect a device has been targeted, when you receive a threat notification, or when a sensitive investigation demands certainty—Honeybadger Solutions provides mobile device forensics, spyware and mercenary-spyware detection, and full incident response. As a Service-Disabled Veteran-Owned Small Business specializing in cybersecurity, digital forensics, and investigations, we help high-risk individuals and organizations determine whether a compromise occurred, understand its scope, and respond with evidence-grade rigor. If a phone in your world has been acting strange—or if standing still no longer feels safe—reach out for a confidential consultation.

About Honeybadger Solutions

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering cybersecurity, digital forensics, and investigative services to clients nationwide. Whether you are dealing with a compromised device, a suspected intrusion, or you simply want to get ahead of these threats, our team can help.

What we do:

Digital forensics — mobile devices (iPhone, Android) and computers (Windows, macOS, Linux); intrusion reconstruction, evidence preservation, and expert-witness reporting
Cybersecurity & incident response — breach investigation, containment, malware and spyware analysis, and remediation
Penetration testing & security assessments — finding the gaps before an attacker does
Managed IT & endpoint security — hardening, monitoring, and patch management for small and mid-sized organizations
Private investigations — including TSCM / technical surveillance countermeasures (“bug sweeps”)
Executive & personal protection

📞 (602) 725-2818 · 🌐 honeybadgersolution.com · Veteran-Owned (SDVOSB) · Licensed & Insured

Concerned a device or network may already be compromised? Contact Honeybadger Solutions for a confidential consultation — we handle mobile and computer forensics, incident response, and everything above.

Related from the Honeybadger Apple & iOS device-security series

Part of Honeybadger Solutions’ security-intelligence series. Explore the rest of the Apple/iOS coverage:

Zero-Click Nightmares: Pegasus, BLASTPASS, and Operation Triangulation on iOS