Considered the holy grail of smartphone exploits, zero-click attacks delivering mobile spyware have played a starring role in such high-profile events as the hacking of Jeff Bezos’s iPhone and Facebook’s lawsuit against an infamous spyware vendor. Though ostensibly rare and used only against high-value targets, zero-click mobile attacks can bring devastating consequences for their victims and demand understanding and perhaps a reevaluation of existing models of mobile security.