An innocent photo can turn your phone into a silent spy

Zero-click attacks: when our digital everyday life betrays us

A WhatsApp message arrives. A photo downloads on its own, the way it happens millions of times a day. You do not click. You do not open it. You do nothing.

And yet your phone is already compromised. A spy in your pocket.

Microphone activated remotely. Messages read in real time. Location tracked. Personal photos exfiltrated. All of it in silence. No notification. No alert. Without you seeing anything at all.

Welcome to the world of zero-click attacks.

What is a zero-click attack?

A zero-click attack asks nothing of its victim. No link to click, no attachment to open, no password to type. All it takes is for the content to arrive and for the device to process it on its own.

This is not science fiction. This is 2025.

Zero-click flaws exploited through malicious images were confirmed on iOS, macOS and certain Samsung Android devices. Not in a theoretical report. Not in a lab. In real life, on real phones, belonging to real people.

Commercial spyware was deployed in silence, hitting journalists, human rights activists, political opponents. These cases are documented by Amnesty International, by the researchers at Palo Alto Networks (Unit 42), confirmed by Meta and added to the catalog of actively exploited flaws maintained by CISA, the US cybersecurity agency.

The attack cycle is terrifyingly simple: identify the target, stealthily send a booby-trapped image, automatic processing by the app, exploitation of the flaw, installation of the spyware, mass data theft. Zero interaction on your part.

And the playing field is immense. During its first-quarter 2025 earnings presentation, Meta announced that WhatsApp had crossed three billion monthly active users. Three billion devices that download images by default.

Meta said it had notified fewer than 200 people for the WhatsApp/Apple campaign of August 2025. That is few. But that is exactly the problem: when it happens, it is invisible.

How can a simple photo hack a phone?

WhatsApp automatically downloads and processes media to display previews. It is convenient. It is fast. And that is exactly where the problem lies.

This processing relies on complex image-decoding libraries, such as ImageIO at Apple or libimagecodec.quram.so at Samsung. Software building blocks that no one sees, but that everyone uses.

A rigged image, often in the DNG format (a RAW format used in photography), triggers a critical error in these libraries: buffer overflow, out-of-bounds write. The malicious code runs. And from that point on, your phone is no longer yours.

The technical detail deserves a close look, because it says everything about the problem. In Apple's case, the flaw fired when the metadata of a DNG file contradicted the actual structure of the compressed image it contained. A gap of a few bytes between what the file announces and what it holds. That is where the security of three billion people is decided: in an arithmetic disagreement inside an image format from 2004.

The documented cases: Apple, WhatsApp, Samsung

On Apple (iOS and macOS). Two chained flaws. CVE-2025-55177 in WhatsApp, an incomplete authorisation of linked-device sync messages, which allowed an unrelated user to trigger the processing of content from an arbitrary URL on a target's device. And CVE-2025-43300 in Apple ImageIO, an out-of-bounds write when processing a malicious image.

Apple published its patch on 20 August 2025, in iOS and iPadOS 18.6.2, iPadOS 17.7.10 and macOS Sequoia 15.6.1, with the formula that comes back in every spyware case: the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals". The fix was then backported in September to iOS 15.8.5, iOS 16.7.12, macOS Sonoma 14.7.8 and macOS Ventura 13.7.8.

WhatsApp published its own advisory on 29 August 2025. Affected were WhatsApp for iOS versions prior to 2.25.21.73, along with WhatsApp Business for iOS and WhatsApp for Mac prior to 2.25.21.78. Meta confirmed to TechCrunch that it had sent "fewer than 200" notifications. Donncha Ó Cearbhaill, who heads Amnesty International's Security Lab, specified that those notifications covered the previous ninety days and that the campaign hit iPhone as well as Android users. No spyware vendor has been formally identified.

On Samsung Android. CVE-2025-21042, an out-of-bounds write in libimagecodec.quram.so, Samsung's image-processing library. That is the door LANDFALL came through, a commercial-grade spyware discovered by Unit 42 and made public in November 2025.

The timeline is the most instructive part of the whole affair. The malicious DNG samples, carrying file names of the "WhatsApp Image" type, had been surfacing on VirusTotal since July 2024. Samsung fixed the flaw in April 2025. The discovery was only published in November 2025. Nine months of active exploitation before the patch, seven more months before the public learned about it.

In the code, Unit 42 found model checks targeting the Galaxy S22, S23, S24, Z Fold4 and Z Flip4, six command-and-control servers hidden behind innocuous domain names, and likely targets in Iraq, Iran, Turkey and Morocco. Once installed, LANDFALL records the microphone, tracks location, collects photos, contacts, SMS messages, files and call logs, and manipulates SELinux to persist.

A second flaw in the same library, CVE-2025-21043, was reported to Samsung by the security teams at Meta and WhatsApp on 13 August 2025 and fixed in the September 2025 update. CVSS score of 8.8. Same library, same file format, same vector.

These vulnerabilities were actively exploited before being fixed. The patches now exist. But the attacks took place.

Does disabling automatic download really protect you?

This is the question I get the most since I started hammering that advice home. And the honest answer is: it is the best move available, it is not a shield.

On 1 September 2025, Google Project Zero reported a weakness in WhatsApp for Android to Meta. An attacker who knows at least one of the target's contacts creates a group, adds the target and that contact to it, possibly promotes that contact to administrator to make it look real, then sends a media file. The file downloads onto the target's device with no interaction at all, because the group passes for legitimate.

Meta rolled out a server-side mitigation on 11 November 2025. Project Zero judged it partial and went public in January 2026, with Meta announcing a full fix at the end of that month.

Two lessons. The first is that Project Zero's recommendation is exactly the one I have been giving from the start: cut off automatic download, or turn on advanced chat privacy. The second is that this setting is itself an attack surface, and that it only holds if the app is up to date.

In other words: the move is still the right one, but it does not replace updates. Both together, or nothing.

The real problem is not technical. It is societal.

You can fix a flaw. You can patch a system. But you do not fix a digital culture with an update.

These attacks reveal something deeper about our relationship with the digital world. Something we refuse to see.

Freedom of expression is retreating in silence. Journalists targeted. Activists surveilled. Opponents silenced. When a simple message can compromise your phone, the fear of speaking freely sets in. This is no longer theoretical, it is documented. On 31 January 2025, WhatsApp notified around ninety users, journalists and members of civil society, targeted by a zero-click exploit delivering Graphite, the spyware of the Israeli company Paragon. On 12 June 2025, Citizen Lab published the first forensic confirmation of that spyware on iPhone, on two European journalists, including Ciro Pellegrino, head of the Naples newsroom of the Italian investigative outlet Fanpage. In February 2026, Amnesty International established the first forensic confirmation of Predator in Angola, on the phone of journalist Teixeira Cândido, contacted on WhatsApp from April to June 2024 and infected after clicking a link on 4 May. Always the same app. Always the same target profile.

We sacrificed security for convenience. We want instant previews, automatic downloads, smoothness everywhere. Without knowing it, we accepted a massive exposure. Every "convenient" feature is one more attack surface.

The most vulnerable are the least protected. In countries where WhatsApp dominates, often those where updates arrive latest, where digital literacy is weakest, the risk is greatest.

Our privacy depends on players we do not control. Meta. Libraries that are sometimes poorly audited. States or private companies that buy these tools off the shelf. Your private life is in the hands of an ecosystem you do not even see.

And this market does not stop at messaging. On 4 December 2025, an investigation led by Inside Story, Haaretz and the WAV Research Collective, with technical analysis from Amnesty International's Security Lab, exposed the internal documents of Intellexa, the vendor behind the Predator spyware. They reveal "Aladdin", a remote zero-click delivery vector that runs through online advertising: the target is designated by their public IP address or by their advertising identifiers, the payload is delivered through programmatic ad-buying platforms, and simply displaying the ad is enough to trigger the infection. Active since at least 2024, still in use in 2025.

Read that sentence twice. The global advertising supply chain, the one that funds a large share of the web you browse, has become a spyware delivery system. WhatsApp is no longer the problem. The problem is the very principle of content that arrives and runs on its own.

On the legal side, Europe has moved. The European Media Freedom Act, Regulation (EU) 2024/1083, has been fully applicable since 8 August 2025, and its Article 4 frames the deployment of spyware against journalists. Frames, not bans: the derogations for national security and serious offences remain open, something organisations such as EDRi have been denouncing since the text was adopted. A law that states the principle and drafts the exception itself protects no one.

95 % of cybersecurity incidents have a human origin, according to the World Economic Forum's Global Risks Report 2022. But 95 % of the discussions stay at the technical level. There is a cognitive dissonance problem right there.

How do you protect yourself from a zero-click attack?

I am not going to give you a course in advanced cybersecurity. The first line of defence is you. And these steps are simple.

1. Disable automatic media download. This is the number one move. The one that cuts the attack vector off at the root, and the one Google Project Zero recommends. On Android: WhatsApp Settings → Storage and data → Media auto-download → uncheck photos. On iPhone: same logic in Settings → WhatsApp → Storage and data. To be thorough, set photos, audio, video and documents, on mobile data as well as on Wi-Fi.

2. Update WhatsApp and your system. Every time. The 2025 fixes closed these specific flaws. But only if you installed them. An ignored update is a door left open. And as the Project Zero case showed, the automatic download setting itself depends on an up-to-date app.

3. Turn on advanced chat privacy for sensitive conversations. Since 2025, WhatsApp has offered a per-chat setting that blocks exporting the thread, prevents automatic media download on participants' devices and keeps the conversation out of AI features. It is set chat by chat, by tapping the contact or group name.

4. For sensitive exchanges, consider Signal. Open source, frequent audits, open code. It is not an absolute guarantee, no tool is, but it is a notch above in terms of transparency.

5. If you are a plausible target, turn on Lockdown Mode. Journalist, lawyer, activist, exposed executive, source. In September 2023, Citizen Lab documented BLASTPASS, a zero-click chain delivering Pegasus on iOS 16.6: Lockdown Mode blocked that attack. It degrades everyday convenience, and that is precisely the trade-off to accept.

6. Watch for unusual signals. A battery that drains abnormally fast. Unexplained overheating. Data consumption that spikes. Unknown apps. Your phone sometimes talks to you. Learn to listen to it.

(source: https://www.online-tech-tips.com/)

(source: https://www.gadgets360.com/)

Beyond the patches: a question of culture

In 2026, the real issue goes beyond technology. This is not an engineers' problem. It is a problem of society.

Demanding more transparency about the software components that process our data. Supporting audited open source alternatives. Pushing for NIS2 to be fully applied and reinforced in Europe. No longer accepting the idea that our digital security is a variable to be traded off against convenience.

Look at the timeline one last time. An image-decoding library exploited from July 2024, patched in April 2025, revealed in November 2025. A WhatsApp flaw reported in September 2025, half-mitigated in November, settled in January 2026. An advertising vector active since 2024, uncovered by a leak of internal documents. Every time, the same gap: the attack runs several months ahead of public knowledge, and several years ahead of regulation.

That gap is what we should be looking at, not the latest CVE. A flaw gets closed. A culture that accepts that everything arrives and runs on its own does not.

A photo that arrives is no longer harmless. It can be a gateway to your privacy, your freedom, your personal security.

Want to know more? I recommend my book Être en cybersécurité.

Disable automatic download starting today. Share this article. And ask yourself the question. Seriously: how far are we willing to go in sacrificing our privacy for instant convenience?

Christophe Mazzola

---

Sources

• WhatsApp, 2025 security advisories, CVE-2025-55177
• Apple, 20 August 2025, "About the security content of macOS Sequoia 15.6.1", CVE-2025-43300
• TechCrunch, 29 August 2025, "WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware" (fewer than 200 notifications, statements from Amnesty International)
• Malwarebytes, September 2025, "WhatsApp fixes vulnerability used in zero-click attacks" (affected versions)
• Unit 42, Palo Alto Networks, November 2025, "LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices"
• The Hacker News, September 2025, "Samsung Fixes Critical Zero-Day CVE-2025-21043 Exploited in Android Attacks"
• Malwarebytes, 27 January 2026, "A WhatsApp bug lets malicious media files spread through group chats" (Google Project Zero disclosure)
• Forbes, 26 January 2026, "WhatsApp Confirms Update After Google Issues 'Attack Surface' Warning"
• Citizen Lab, March 2025, "Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations"
• Citizen Lab, 12 June 2025, "Graphite Caught: First Forensic Confirmation of Paragon's iOS Mercenary Spyware Finds Journalists Targeted"
• Amnesty International Security Lab, 4 December 2025, "To Catch a Predator: Leak exposes the internal operations of Intellexa's mercenary spyware"
• Amnesty International, February 2026, "Angola: Prominent journalist hacked with Predator spyware"
• Citizen Lab, September 2023, "BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild"
• European Board for Media Services, 8 August 2025, main obligations of Regulation (EU) 2024/1083 become applicable
• World Economic Forum, Global Risks Report 2022, chapter 3
• Siècle Digital, 2 May 2025, "Avec 3 milliards d'utilisateurs, WhatsApp confirme son statut de messagerie la plus puissante de la planète"
• CISA, Known Exploited Vulnerabilities Catalog: CVE-2025-43300 (August 2025), CVE-2025-55177 (September 2025), CVE-2025-21042 (10 November 2025)