Over the past few years, I’ve helped respond to security incidents where one of my first questions was, “What happened before you noticed something was wrong?”
Often, the person would tell me, “I didn’t click a link. I only opened the email.”
That gave us a starting point, but we still needed to investigate. We would walk through what they remembered and compare it with the security alerts.
In some of these incidents, we saw attempts to contact command-and-control servers, systems attackers use to communicate with malicious software.
Those alerts helped us understand what the device was doing. They did not, by themselves, tell us how the attack began or whether opening the email caused it.
Understanding what happened meant listening to the person and checking the evidence on the device.
Those experiences reminded me that protecting a business takes more than telling people to avoid suspicious links. Employees need clear guidance, and businesses need protections that can detect and respond when something goes wrong.
What Is a Zero-Click Attack?
Zero-click means the attacker does not need you to click, tap, or open anything to start the attack.
Your phone or computer does some work in the background. For example, a messaging app may process a picture before you open the conversation.
If that software has a security weakness, an attacker may send specially crafted content that takes advantage of it. The attack can happen while the device handles the content automatically.
Think of it like a broken mail slot. You never open the door, but someone can still misuse the opening.
The attacker uses a weakness in the software instead of persuading you to click.
In 2023, Citizen Lab documented BLASTPASS, an attack that delivered Pegasus spyware through malicious image attachments sent using iMessage. Researchers reported that it could compromise affected iPhones without interaction from the person receiving the message. Apple released security updates addressing the flaws. [1]
This is a documented historical example, not a warning that every incoming image will infect a phone.
Even when employees avoid suspicious links, their devices still need security updates to fix software weaknesses.
Can Spyware Exploit Browsers and Other Unpatched Software?
Yes. Attackers can exploit weaknesses in browsers, operating systems, and apps to compromise a device. Depending on the attack, they may install spyware or other malicious software.
This matters for Windows PCs, Macs, Linux computers, Chromebooks, iPhones, iPads, and Android devices. The specific weaknesses and available fixes differ by product.
Each device needs updates for its operating system and the apps installed on it. Updating a browser does not fix every weakness in the operating system, and an operating-system update does not necessarily update every app.
Google has documented spyware campaigns that combined zero-day flaws with known flaws on devices that had not received available fixes. [6]
Here is the difference in plain language:
Zero-click: The attack does not require the person to interact with the harmful content.
Zero-day: Attackers exploit a newly discovered or previously unknown weakness before a security fix is publicly available. [7]
Unpatched browser: The browser has a security weakness that has not been fixed on that device. If a fix is already available, exploiting that known flaw is generally called an n-day attack, rather than a new zero-day attack. [8]
A browser can also be attacked when someone visits a harmful or compromised website. The page may exploit the browser automatically, without another click or an installation prompt. This is often called a drive-by attack. Needing no further click after a page loads does not, by itself, make the whole attack zero-click.
Think of it this way: zero-click tells you whether the person had to interact. Zero-day tells you about the weakness and whether a fix was available.
An attack can be both, but the terms are not interchangeable. An older browser attack that originally used a zero-day can also remain dangerous to devices that miss the later security update.
Install available fixes promptly. An update cannot fix an unknown flaw before a fix exists, which is why businesses need more than one layer of protection.
Should Every Small Business Be Worried About Targeted Spyware?
Take the issue seriously without assuming every employee is a target.
Apple says sophisticated mercenary spyware attacks focus on a very small number of selected people and that most users will never be targeted. [2]
Your business can use that perspective to choose sensible protections: keep software current, manage work devices, protect accounts, and have a clear reporting process.
Build reliable everyday defenses instead of chasing every alarming headline.
Another Trap: When the Whole Email Acts Like a Link
Now consider a different situation.
An employee receives an email that looks like a document notice or account alert. There is no obvious blue link to avoid. They click the text or logo, and a website opens.
What happened?
An attacker can make the visible message one large clickable image. They can also place a link around a large section of the email. What looks like ordinary text, a logo, or background space may sit inside that clickable area.
Cisco has documented a phishing example in which the message was an image linked to a phishing website. Clicking anywhere on that image opened the destination. [3]
The destination can hide behind the message itself. Text, logos, and even background space may be part of one large clickable area.
A link does not have to look like a link.
Zero-click attack: Harmful content exploits a software weakness without requiring a click or tap.
Hidden-link phishing: Someone clicks or taps part of the email, sometimes without realizing it is a link.
A click does not automatically mean a device was infected or an account was stolen. But it should be reported promptly so IT can check what happened.
Report what happened, even if you are unsure what you clicked.
Why Your Business Needs a Monthly Update Routine
Why install updates when the computer seems to be working fine?
A device can work normally and still have a security weakness. Updates can repair those weaknesses before an attacker uses them.
Think of a security update as repairing a faulty lock. Discovering the problem does not repair the lock on every computer. Each affected device still needs the fix installed.
Your update routine should cover every type of device used for work, including Windows PCs, Macs, Linux computers, Chromebooks, iPhones, iPads, and Android phones and tablets. Include shared devices and personal devices approved for business use.
-Make a monthly update routine part of running your business:
Install operating-system security updates across all work devices. Have your IT provider review, test as appropriate, and deploy available fixes promptly. Include computers, phones, and tablets, even those frequently used away from the office.
Check browsers, apps, and connected equipment. Email software, document readers, and messaging apps may update separately. Routers, firewalls, printers, and other connected business equipment may also need firmware updates, which repair the software built into the device. Keep automatic updating enabled where appropriate.
Complete required restarts. Downloading an update is not always enough. Some fixes need a restart to finish installing.
Verify that updates succeeded and devices still receive support. Check for failed installations, paused updates, and devices that have been offline. If a device or software version no longer receives security fixes, plan its upgrade or replacement with your IT provider. Assign someone to follow up.
Respond sooner when a fix is urgent. If attackers are actively exploiting a weakness, your IT provider may need to act before the next monthly maintenance window.
For company managed devices, follow your IT team's update instructions rather than changing update settings yourself.
A monthly check is a baseline. Browsers, security tools, and urgent fixes may need attention more often. Updates also cannot prevent every attack, especially before a fix exists for a new flaw.
Keep a monthly routine, complete the restarts, and do not wait for next month when a security fix is urgent.
Five Practical Steps for Your Business
1. Make Updates Someone’s Responsibility
Assign someone to manage the update routine above and confirm that fixes are installed across all devices used for work.
2. Teach Employees to Avoid the Entire Suspicious Message
Update the advice from “don’t click the button” to “don’t interact with a suspicious email’s content.”
On a computer, hovering can reveal a link destination, but an unfamiliar address is a reason to stop, not investigate by clicking.
For an unexpected account or document request, open the trusted app or a saved bookmark directly. Verify unusual requests through a known contact method. Use your email app’s reporting control or your company’s approved reporting process. [4]
3. Protect Accounts and Limit Access
Ask your IT provider about passkeys or other phishing-resistant MFA where available. Employees should have the access they need for their work, with administrator access limited to appropriate tasks and people.
These controls address account and access risks. They do not patch the software flaw behind a zero-click exploit.
4. Check What Your Security Tools Actually Cover
Ask whether your business tools protect laptops, phones, email, or some combination. Find out who reviews alerts and what happens when a device stops reporting.
Do not assume a product installed on a laptop also protects a phone. No single security tool guarantees protection from every attack.
5. Make Reporting Easy and Calm
Give employees one clear contact for suspicious messages and security alerts.
If someone clicked, ask whether a page opened, a file downloaded, a password was entered, or a sign-in request was approved. Have them stop interacting and contact IT promptly. If credentials were entered, IT should help secure the account and review active sessions. [4]
For a credible targeted-spyware alert, get qualified assistance before wiping or resetting the device. Apple advises recipients of its threat notifications to seek expert help. [2]
Fast reporting gives your business a chance to respond sooner.
Your Next Step: Check One Work Device
Choose one computer, phone, or tablet used for work.
Check whether its operating system and browser have pending security updates. Install approved updates and complete any required restart. For company-managed devices, ask IT to confirm its update status.
Then make sure you know where to report a suspicious email, even if you never clicked a visible link.
Start with one device, then make these checks part of your business routine.
Keep Learning With SimplifySec
Want to recognize more ways attackers try to gain access? Explore these related articles:
That Microsoft Login Request Could Be a Scam: Understanding Device Code Phishing: How attackers use a real sign-in process to trick you into granting access.
Smishing and Fake WhatsApp Signature Requests: How to check unexpected messages before responding.
Are Employees Using AI Without Your Knowledge? Understanding Shadow AI: How unapproved AI tools can expose company information and what your business can do about it.
Take the Next Step
Not sure where your business stands? Start with our FREE Small Business Cybersecurity Checklist, a 10-minute review to help you spot gaps and choose what to tackle first.
Get the Free Small Business Cybersecurity Checklist
For ongoing help, sign up for SimplifySec Weekly Security Tips for plain-language advice on scams, account security, and protecting your devices.
Start with one improvement, then build from there.
Stay safe,
The SimplifySec Team
Simple. Practical. Cybersecurity.
Sources
Cisco Live: Email Security Presentation, Credential Phishing Example, PDF page 35
Google: Analyzing a Watering Hole Campaign Using macOS Exploits
Disclaimer
The content on this blog is published by SimplifySec Group LLC for general educational and informational purposes only. It is not legal, financial, or professional cybersecurity advice, and reading a blog post does not create a professional-client relationship between you and SimplifySec.
Cybersecurity risks depend on your specific environment, and recommendations that work for one system or business may not be appropriate for yours. You should evaluate your own circumstances and consult a qualified professional before acting on anything you read here. SimplifySec makes no warranty that the information is complete, current, or error-free, and to the fullest extent permitted by law disclaims liability for any loss arising from your reliance on it.
This blog may link to or reference third-party tools, vendors, or resources for convenience. SimplifySec does not endorse, control, or assume responsibility for those third parties or their content.
© 2026 SimplifySec Group LLC. All rights reserved.
