Immigration and Customs Enforcement has locked in a $2 million contract for spyware that can break into phones without the target clicking anything.
The deal gives ICE access to phone-hacking tools that exploit devices remotely - no phishing link, no malicious attachment, no user error required. Zero-click exploits like this typically target flaws in messaging or call-handling software to plant surveillance code silently, and they are prized precisely because there is no visible prompt for a target to avoid. A $2 million price tag suggests a narrow, high-end capability rather than a mass-market tool rolled out agency-wide.
Zero-click spyware removes the last line of defense between a target and surveillance: user awareness. For an agency focused on immigration enforcement, that capability raises the stakes on who gets targeted and under what legal standard, since there is no click-through mistake or obvious compromise to alert a device owner or an oversight body.
It is the same category of tool that turned NSO Group's Pegasus into a global controversy - now a similar capability is showing up on a domestic agency's purchase order.