You Don't Have to Click Anything to Get Hacked Anymore
The days when hackers needed you to click a suspicious link are largely over. Modern spyware — including commercial tools like Pegasus — can silently infiltrate smartphones through what researchers call "zero-click" exploits. These attacks require no interaction from the target whatsoever, making them especially dangerous for journalists, activists, lawyers, and anyone else who might be in the crosshairs of a sophisticated attacker.
The good news: Apple, Google, and Meta have all developed specialized security modes designed to dramatically reduce your device's attack surface. They won't stop every threat, but they make zero-click and targeted attacks significantly harder to pull off.
Apple's Lockdown Mode
Introduced in iOS 16, Lockdown Mode is Apple's most aggressive protection setting. When enabled, it restricts a wide range of features that are common attack vectors — including most message attachment types, certain web browsing technologies, wired connections to computers, and configuration profiles.
The trade-off is real: some apps and websites won't work normally in Lockdown Mode. It's not designed for everyday users, but if you believe you could be targeted by state-sponsored spyware, the friction is worth it.
To turn it on: go to Settings → Privacy & Security → Lockdown Mode and tap "Turn On Lockdown Mode."
Google's Advanced Protection Program
On Android, Google's answer is the Advanced Protection Program — a suite of security measures originally built for high-risk individuals like politicians and executives. Enrollment requires physical security keys for sign-in and limits which third-party apps can access your Google account data.
Google has also added on-device scanning features to detect malicious apps, and newer Pixel devices include a Memory Tagging Extension (MTE) that makes entire classes of software exploits much harder to execute.
To enroll: visit g.co/advancedprotection and follow the steps.
Meta's Security Checkup and Extra Protection
Meta offers a Security Checkup feature across Facebook, Instagram, and WhatsApp that audits your login activity, connected apps, and two-factor authentication settings. WhatsApp specifically now includes an Advanced Chat Privacy option and login notification alerts that can catch unauthorized access early.
For WhatsApp, enabling two-step verification under Settings → Account adds a critical layer that prevents SIM-swap attackers from taking over your number.
General Best Practices That Still Matter
Even with these modes enabled, a few fundamentals go a long way:
- Keep your OS updated. Most zero-click exploits target unpatched vulnerabilities. An update often closes the door before attackers can walk through it.
- Reboot your phone regularly. Some spyware can't survive a restart, making regular reboots a simple but effective mitigation.
- Audit your apps. Remove anything you don't actively use. Every app is a potential attack surface.
- Use a reputable VPN on public Wi-Fi. Network-level attacks remain a real threat in coffee shops and airports.
Who Actually Needs These Modes?
Most people will never face targeted spyware. But for journalists, human rights workers, lawyers handling sensitive cases, or anyone who's received threats, these tools are genuinely worth the minor inconvenience they introduce. Enabling them costs nothing but a few minutes of setup.
For everyone else, keeping software updated and enabling two-factor authentication on all major accounts remains the single highest-impact security habit you can build.
Source: TechCrunch, May 23, 2026
