How Pegasus zero click spyware infects a phone

The idea, without a recipe

Modern phones automatically parse incoming messages, images, link previews, and call-setup signals before a person touches anything. A zero-click chain abuses that parsing so the target never has to tap a link or open an attachment. The phone compromises itself.

Contrast this with one-click exploits, which require the target to interact — typically tapping a link. And contrast it with network injection, where traffic is redirected en route, sometimes with carrier cooperation, to deliver an exploit or implant.

Zero-click is the hardest to detect because it leaves almost no user-visible trace. Forensic labs often find it only by parsing a backup or examining device logs for indicators of compromise — and even then, implants can self-delete and logs rotate.

Why encryption does not help here

End-to-end-encrypted apps like Signal, WhatsApp, and iMessage protect data in transit. But a device-level implant reads the content after it is decrypted on the phone — the same moment the user sees it. This is why E2EE alone does not stop a resident implant, and why "I use Signal" is not, by itself, a defense against Pegasus.

Publicly named chains

The chains below are described at a high level only: what app or parser was hit, when it was active, and the patch. Each named chain was patched. New chains have historically followed patches, so an updated phone is necessary but not sufficient assurance.

What this page does not do

It does not provide exploit code, byte patterns, payloads, reproduction steps, or any instruction for building, buying, deploying, or hiding spyware. It describes only what has been publicly documented by forensic labs, courts, and security vendors.