New research shared with Axios suggests hackers are finding new ways to infect iPhones with spyware, even when victims never click a malicious link. The finding points to a worrying trend in zero-click iPhone spyware browsing, where simply loading a web page may be enough to put a device at risk.

The details available from the report are limited, so this post sticks to what has been published and explains what it means in practical terms.

How Browsing Alone Can Infect an iPhone

The core claim in the research is that hackers can deliver spyware to iPhones without the victim clicking a malicious link. In a typical phishing attack, the user has to take an action: tap a link, open a file, or approve a prompt. Here, that step is reportedly removed from the process.

That matters because most security advice focuses on user behavior: don't click suspicious links, don't open unknown attachments. Those habits are still useful, but they offer less protection when an attack is designed to work in the background while someone browses normally.

The browser is a natural place for this kind of attack. It constantly processes untrusted content from across the internet, including pages, scripts, images, and ads. If an attacker finds a flaw in how that content is handled, a booby-trapped page can run code on the device. We have covered how attackers are changing browser-based delivery in our report on hackers who now assemble malware in the browser, and the same principle applies here: the browser itself becomes the delivery route.

The summary we reviewed does not name specific vulnerabilities, threat groups, or victims, so we won't speculate about them.

Who Is Most at Risk From This Spyware

Spyware of this kind has historically been associated with targeted surveillance rather than mass infection, but the research summary does not say who is being targeted in this case. We can't make claims about specific victims.

What can be said is that anyone who browses the web on an iPhone is exposed to the general category of risk, because the attack path runs through ordinary browsing. People with a higher profile, such as journalists, activists, executives, and government staff, generally have more reason to take extra precautions, because they are more likely to be of interest to well-resourced attackers.

For most people, the practical risk is likely lower than for those groups, but the lesson is the same: the safest assumption is that an unpatched device is a weaker device.

What a VPN Does and Doesn't Stop

This is where expectations need to be realistic. A VPN encrypts the traffic between your device and the VPN server and hides your IP address from the sites you visit. That is valuable for privacy on public Wi-Fi and for limiting what your internet provider can see.

But a VPN does not fix a vulnerability in your browser or operating system. If a malicious page exploits a flaw in how your iPhone processes web content, the exploit arrives through the connection you chose to make, whether or not that connection is encrypted. The VPN tunnel carries the page to your device just as it would carry any other page.

A VPN may offer some indirect help if it includes optional blocking of known malicious domains, though that depends on the service and is not a substitute for patching. Encrypted DNS, explained in our glossary entry on DNS over HTTPS, keeps lookups private from third parties, but it likewise does not stop a browser exploit.

In short: a VPN is a privacy tool, not a defense against zero-click exploits. Software updates are the main defense. For a comparable example of how attackers chain browser flaws, see our coverage of Chinese hackers exploiting Chrome and Windows zero-days.

Steps to Protect Your iPhone Now

You can't control whether a flaw exists, but you can shrink the window in which it is useful to an attacker.

  • Install the latest iOS update. Security patches are the most direct protection against browser-based exploits.
  • Turn on automatic updates. Go to Settings, then General, then Software Update, and enable automatic updates so you don't fall behind.
  • Consider Lockdown Mode if you are high-risk. Apple's Lockdown Mode is an optional setting that reduces the device's attack surface. It limits some features, so it suits people with a elevated threat profile rather than everyone.
  • Restart your iPhone occasionally. This is a general hygiene habit and not a guarantee of removal.
  • Keep apps updated and remove ones you don't use.

What This Means For You

The key takeaway is that "don't click suspicious links" is no longer enough on its own. If the research is right, ordinary browsing can be part of the attack chain. That doesn't mean you should stop using your phone or panic. It means your update habits matter more than ever, and that you should treat a VPN as one layer of privacy rather than a shield against spyware.

Conclusion

Zero-click iPhone spyware browsing is a reminder that the browser is one of the most exposed parts of any device. Install the latest iOS update today, switch on automatic updates, and enable Lockdown Mode if you believe you could be a target. For more context on how browser-based attacks work, read our pieces on in-browser malware assembly and the Chrome zero-day exploitation campaign.