For years, the advice has been simple: don’t click suspicious links and don’t open strange attachments. But a new type of threat doesn’t need you to click anything at all.
Zero-click attacks can infect a device just by showing it an email or an advert. Two recent stories show how real this risk has become, and why UK businesses need to think beyond staff awareness alone.
As a provider of managed IT support in Essex, London and the South East, we explain what zero-click attacks are and how to keep your business protected.
What Is a Zero-Click Attack?
A zero-click attack is a cyber attack that needs no action from the victim. There’s no link to click, no file to open and no password to enter.
Instead, attackers exploit a flaw in software that processes content automatically. That could be an email app showing a preview, a browser loading an advert, or a messaging app receiving a message.
The moment the content appears on screen, malicious code can run in the background. To the user, nothing looks wrong. That’s what makes these attacks so dangerous: even careful, well-trained staff can’t spot them.
Example 1: Spyware Hidden in Online Adverts
In October 2026, Al Jazeera reported findings from Citizen Lab, a research group at the University of Toronto. Researchers found that Candiru, an Israeli spyware firm, used malicious online adverts to target 45 devices belonging to Al Jazeera staff in June 2025.
The ads were bought through Discover-Tech, a company posing as a normal advertising firm. It even appeared on approved vendor lists maintained by Google and IAB Europe.
Here’s how the attack worked:
- Advertising networks share data such as device ID, IP address and rough location in every ad auction.
- Attackers used this data to target specific people, without needing their email address or phone number.
- The malicious ads could infect a device simply by appearing on screen.
- Once installed, the spyware could collect files, saved passwords, keystrokes, screenshots, and microphone and webcam input.
The ads also appeared on networks used by government bodies in at least 24 countries, as well as the UN, NATO and EU institutions.
Example 2: Outlook Flaws Triggered by the Reading Pane
Closer to home for most businesses, Microsoft’s October 2026 security update fixed five remote code execution flaws in Outlook where the Reading Pane is the attack route.
According to security firm Rapid7, simply scrolling past a malicious email in the Reading Pane could be enough to trigger an attack. One of these flaws, CVE-2026-70242, is rated critical with a CVSS score of 9.8.
There’s no evidence yet that these Outlook flaws have been used in real attacks. But this isn’t the first time: Microsoft fixed a similar zero-click Outlook flaw, CVE-2026-40361, in May 2026.
What Does This Mean for UK Businesses?
Zero-click attacks are a growing risk for businesses of every size. Attackers are finding ways in that don’t rely on human mistakes at all.
Every business that uses Outlook, a web browser or a smartphone relies on that software being secure. If a flaw goes unpatched, a single email or advert could be enough to give attackers access to your data, emails and systems.
Traditional advice like “think before you click” is still important, but it won’t stop an attack that needs no click at all. Protection now depends on your technology being properly managed.
How to Protect Your Business from Zero-Click Attacks
1. Keep everything updated
Zero-click attacks rely on software flaws. Install security updates for Windows, Office, Outlook, browsers and phones as soon as they’re released. Microsoft’s October 2026 update alone fixed over 1,400 vulnerabilities.
2. Turn on automatic patching
Don’t rely on staff to click “update later”. Managed patching makes sure every device is protected, not just some.
3. Filter emails and web traffic
Email filtering can block malicious messages before they reach the inbox. DNS filtering and ad blocking on business devices can stop harmful adverts from loading.
4. Manage company phones
Use mobile device management (MDM) to keep staff phones updated and secure. Switching off advertising IDs reduces how much data advertisers, and attackers, can collect.
5. Protect high-risk staff
Directors and finance teams are common targets. Features like Lockdown Mode on iPhone and Advanced Protection on Android add extra security for people most at risk.
6. Use endpoint protection
If something does get through, endpoint protection can spot unusual activity and stop it before it spreads.
How Sprint Integration Can Help
We help businesses across London, Essex and the South East stay ahead of threats like these.
Unpatched devices leave the door open. We manage updates across your laptops, servers, Microsoft 365 and phones, so security fixes are installed quickly.
Malicious emails reach your inbox. We set up email filtering and SPF, DKIM and DMARC to block threats before staff ever see them.
Staff phones are unmanaged. We secure company mobiles with device management, so they stay updated and protected.
Threats slip through unnoticed. Our cyber security and endpoint protection spots suspicious activity and stops it early.
You’re not sure where your gaps are. We guide you through Cyber Essentials, giving you a clear security baseline.
Want to know how well protected your business really is? Book a free IT Health Check and we’ll review your setup.
FAQs
What is a zero-click attack?
A cyber attack that infects a device without the user clicking, opening or downloading anything.
Can zero-click attacks affect small businesses?
Yes. Any business using common software like Outlook, web browsers or smartphones could be exposed if updates aren’t installed.
Does staff training stop zero-click attacks?
Not on its own. Training helps with phishing, but zero-click attacks need technical protection like patching and filtering.
What’s the best way to protect my business?
Keep all software updated, use email and web filtering, and add endpoint protection.
