ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “zero-click”

75 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 147Vulnerability 140Exploit / PoC 119Ransomware 23Threat actor 14Data breach 14AI safety & security 9Policy & legal 9Phishing & fraud 6Industry 5Advisory 4AI tools & infra 2
SeverityAllcritical 283high 76medium 78low 49info 6

Pegasus and NoviSpy Used Against Serbian Protesters

Citizen Lab confirmed zero-click Pegasus infected a Serbian student activist's iPhone, part of the largest documented Serbian spyware wave targeting at least 14 people.

The Citizen Lab, with the SHARE Foundation, confirmed a Serbian student protest movement member's iPhone was infected with NSO Group's Pegasus via an iMessage zero-click exploit between December 2025 and January 2026; Apple patched the exploit in iOS 18.4.1. SHARE Foundation has documented at least 14 targeted individuals since early 2026, including student activists, civil society figures, an opposition MP and a local councilor, coinciding with the March 2026 local elections. SHARE and Amnesty Tech also found a new NoviSpy variant on a student activist's Android phone after Serbian authorities seized it during police questioning.

Security Affairs · 12d agoThreat actor in the wild

Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution

Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.

Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.

Security Affairs · Aug 11, 2026VulnerabilityCVE-2026-53413CVE-2026-53414CVE-2026-53415

MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.

A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.

Cyber Security News · 6d agoVulnerability 2 sourcesCVE-2026-85061

Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone

Citizen Lab confirms Pegasus zero-click iMessage spyware infected a Serbian student activist's iPhone amid at least 14 spyware targets in Serbia during 2026.

The Citizen Lab, with the SHARE Foundation, confirmed an iMessage zero-click exploit infected a Serbian student protest movement member's iPhone with NSO Group's Pegasus spyware, with high-confidence indicators from December 2025 to January 2026. The exploit was addressed by Apple in iOS 18.4.1, released April 2025. At least 14 people in Serbia, including students, activists, an MP, and a councilor, were targeted with advanced spyware since the start of 2026, coinciding with March 29, 2026 local elections; a new Android spyware similar to NoviSpy was also found on a confiscated device.

The Hacker News · 13d agoThreat actor in the wild

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.

Security firm Calif built a worm that seized WeChat accounts via incoming calls without any target interaction, demonstrating it spreading across three test phones (Android to iPhone to Android). Once exploited, the attacker gains full control of the WeChat account, including messages, calls, payments, and mini programs, though not the phone itself. Tencent mitigated the flaw server-side, confirmed blocked on 28 August, shipping WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. No CVE has been assigned, Tencent published no advisory, and no attacks in the wild have been reported; WeChat/Weixin counts 1.439 billion monthly active users.

The Hacker News · 7d agoVulnerability1

“Zero-click” WeChat worm could hijack accounts and spread via a single call

Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.

Calif researchers weaponized a memory corruption issue in WeChat's VoIP stack into "WeWorm", a worm that spreads through WeChat calls without user interaction, hijacks each victim's account, and propagates via saved contacts across iOS and Android, potentially reaching millions of devices within hours. Exploitation takes seconds and grants full account control, and chaining with other reported Android/iOS bugs could lead to full device control. Tencent issued updated WeChat versions for iOS and Android and applied server-side mitigations; technical details remain withheld. WeChat has over a billion users, overwhelmingly in China.

Help Net Security · 7d agoVulnerability

WeChat worm could pwn a friend before they even answered the call

Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.

Security firm Calif found a memory corruption bug in WeChat's VoIP stack that let a trusted contact take over a user's account simply by calling them, without the call being answered. The demo worm then called the victim's contacts to self-propagate across iOS and Android; declining the call prevented infection. Tencent pushed fixes on August 21, and Calif said chaining the bug with other Android and iOS flaws could yield full device control. Calif used AI to find the vulnerability and build its first RCE exploit in about two days.

The Register · Securityupdated · 6d agofirst · 6d agoExploit / PoC 3 sources

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.

Researchers at Calif exploited a memory corruption bug in WeChat's VoIP system, taking over accounts through an incoming call even if the victim never answers or touches the phone. The attacker must already be a WeChat contact, but compromising a friend's account bypasses this, and chained calls spread the worm across three Android and iOS test phones in seconds. Tencent fixed the flaw in Android 8.0.77 and iOS 8.0.76 released in August, and researchers found no evidence of real-world exploitation. WeChat and Weixin reported 1.418 billion combined monthly active users at the end of 2025.

Security Affairs · 7d agoExploit / PoC

Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client

A Security researchers disclosed three Zoom annotation flaws enabling zero-click client hijacking; Zoom shipped fixes in June and July with no exploitation reported.

Researchers at A Security found three flaws in Zoom's annotation feature: CVE-2026-53413 (CVSS 8.3, buffer over-write), CVE-2026-53414 (CVSS 6.5, buffer over-read), and CVE-2026-53415 (CVSS 8.3, use-after-free). A crafted drawing object sent over the wrong message channel can overwrite adjacent memory and hijack another attendee's client with no user interaction. Fixes shipped in Zoom Workplace 7.1.5/7.0.6, VDI Client 7.0.11/6.6.16, and Zoom Rooms/Meeting SDK 7.1.0+ during June and July. No exploitation has been reported and the flaws are absent from CISA's Known Exploited Vulnerabilities catalog.

The Hacker News · Aug 11, 2026VulnerabilityCVE-2026-53413CVE-2026-53414CVE-2026-53415

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

Researchers confirmed the first 2026 Pegasus infection and a new NoviSpy variant on 14 Serbian activists, likely surveillance by Serbian authorities ahead of elections.

Citizen Lab confirmed with high probability the first forensically confirmed Pegasus infection of 2026, on a Serbian student activist hacked via a zero-click exploit between December of last year and January. Amnesty International confirmed two devices infected with a new NoviSpy variant, and the SHARE Foundation documented 14 targets including a member of parliament and a local government official, the largest documented spyware wave in Serbia to date. Evidence points to Serbian police or intelligence services, with NoviSpy infections occurring around police detention ahead of key local and parliamentary elections. Apple threat notifications preceded the findings, and updated iOS versions break the exploit chain.

CyberScoop · 13d agoThreat actor in the wild

Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks

Google patched CVE-2026-58704, an actively exploited Android zero-day allowing proximal privilege escalation via the Pixel cellular modem, urging the 2026-09-05 patch.

Google confirmed CVE-2026-58704, a high-severity elevation-of-privilege flaw in the Pixel cellular modem, is being exploited in limited, targeted attacks and shipped emergency fixes in the September 2026 Pixel Update Bulletin. The low-complexity bug requires no user interaction and enables proximal/adjacent privilege escalation with no additional execution privileges, phrasing Google has historically used for spyware-vendor and state-aligned zero-days. The Pixel bulletin patches 110 flaws including 12 critical RCEs, while the broader September Android update addressed roughly 180 vulnerabilities, including Wi-Fi memory-corruption bug CVE-2026-28662.

Cyber Security News · 1h agoExploit / PoC in the wild 2 sourcesCVE-2026-58704CVE-2026-28662

Large group of Serbian opposition, activist figures targeted with spyware

Researchers found at least 14 Serbian opposition figures and student protesters targeted with Pegasus and NoviSpy spyware around elections; 11 more phones under investigation.

The SHARE Foundation, with Citizen Lab confirmation and Amnesty International peer review, found at least 14 Serbian opposition and civil society figures targeted with advanced spyware since December, including a member of Parliament, a local politician and student protesters. Citizen Lab confirmed zero-click Pegasus on a student protester's iPhone between December 2025 and January 2026, while Amnesty confirmed a new detection-evading NoviSpy Android variant in at least two cases. Targeting coincided with March 2026 local elections; Serbia's BIA intelligence agency denied the claims, and 11 additional alerted phones remain under forensic investigation.

The Record · 12d agoThreat actor in the wild