Zero-Click Spyware: How Infection Works Without Touching the…

Zero-day attacks on smartphones exploit unknown vendor vulnerabilities to install spyware without any user interaction. A Bitdefender analysis breaks down the technical mechanisms and the defensive challenge.

An unopened message. An unseen image. A missed call. These mundane events can trigger background code execution and install spyware capable of reading messages, tracking location, and activating the microphone and camera. Bitdefender has published an analysis that reconstructs the mechanics of these zero-click attacks: infection occurs without the victim ever touching the phone, opening a message, or clicking a link.

Key Takeaways

Zero-click attacks use specially crafted data to execute code in the background without any victim interaction.
CVE-2025-48595, an Android Framework vulnerability enabling remote privilege escalation without user interaction, is actively exploited with indications of limited, targeted exploitation.
Documented historical campaigns — Pegasus via iMessage, Operation Triangulation with invisible attachments, Predator impersonating legitimate sites — illustrate shared techniques among commercial spyware vendors.
Apple Lockdown Mode and timely updates are defenses cited by Bitdefender, with documented impacts on device functionality.

The Mechanism: From Crafted Data to Phone Control

In zero-click attacks, specially crafted data triggers background code execution without any action by the victim. Bitdefender describes the process: something as innocuous as a malicious text message can trigger automatic code execution, bypassing every traditional behavioral barrier.

Attackers often chain multiple vulnerabilities in exploit chains to overcome protections and ensure persistence. The typical path traverses system components such as iMessage, image renderers, and GPU drivers up to the kernel, gaining elevated privileges at each stage.

Bitdefender cites emblematic campaigns. NSO Group's Pegasus used zero-click exploits via iMessage to infect iPhones belonging to journalists, activists, and diplomats: victims were infected without opening messages or clicking links. Operation Triangulation, in 2023, employed invisible iMessage attachments to gain deep system access on iOS. Predator, from the Intellexa alliance, targeted both Android and iPhone with malicious links and advanced exploits, impersonating legitimate organizations to lure visits to malicious pages.

CVE-2025-48595: A Vulnerability Separate from Historical Campaigns

In June 2026, Google published the Android security bulletin with patch level 2026-06-05 or later, which fixes CVE-2025-48595. The primary source, source.android.com, documents the vulnerability in the framework. GBHackers, reporting Google's indication, confirms the bug allows remote privilege escalation without user interaction, with "indications of limited, targeted exploitation in the wild."

The operational timeline follows the standard Android model: pre-notification to partners at least one month before bulletin publication, AOSP patch release within 48 hours of publication. The data does not specify actual distribution times to end users, which depend on device vendors.

Explicit separation: The dossier does not establish a link between CVE-2025-48595 and the specific campaigns cited by Bitdefender — Pegasus, Predator, Operation Triangulation. The CVE corroborates the general phenomenon of zero-interaction attacks, but does not constitute evidence of the same event or the same threats.

The Commercial Spyware Industry: Documented Convergence in 2022-2023

The Google Threat Analysis Group, in documentation dating to 2022-2023 reported via Cybersecurity-help.cz, described spyware campaigns illustrating this convergence. One campaign employed exploit chains for iOS with CVE-2022-42856 zero-day and for Android with CVE-2022-3723, CVE-2022-4135, and CVE-2022-38181. A second campaign, in December 2022, combined zero-day and n-day vulnerabilities in Samsung Internet Browser, deploying C++ spyware with data-capture capabilities from messaging applications.

"These campaigns are a reminder that the commercial spyware industry continues to thrive. Even smaller surveillance vendors have access to 0-days, and vendors stockpiling and using 0-day vulnerabilities in secret pose a severe risk to the Internet." — Google Threat Analysis Group, 2022-2023

The sharing of exploits and techniques among commercial surveillance vendors is documented in historical sources. The dossier does not, however, quantify the claim that techniques once associated primarily with intelligence agencies are now adopted by other actors without supporting data.

What to Do Now: Risk Profile Assessment Criteria

Bitdefender mentions two defenses: timely updates and Apple Lockdown Mode. Their relevance varies based on the user's risk profile.

High-risk users (journalists, activists, diplomats, executives in sensitive sectors): Apple describes Lockdown Mode as an "extreme" measure that reduces the attack surface. Disabled features include link previews in Messages, attachments in certain formats, FaceTime calls from unsaved contacts, and configuration profiles. The source does not specify whether these limitations are acceptable for all profiles.

Patch level verification: For CVE-2025-48595, the fix requires patch level 2026-06-05 or later. Users can verify the security level in Android system settings, under Software Updates. The source does not specify distribution timelines for individual vendors.

Standard consumer and enterprise users: Adoption of Lockdown Mode is not indicated by Bitdefender as a general measure. The source does not specify prioritization criteria for intermediate risk profiles nor adoption rates for the measure.

The Source Limit

The analysis is based on a Bitdefender editorial article, a security vendor with commercial interest, not on independent original research. The cited spyware campaigns are documented in historical sources; it is not verified that they represent ongoing activity in 2026. It is not confirmed that CVE-2025-48595 is linked to specific spyware campaigns nor that Bitdefender discovered new zero-day vulnerabilities.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references