Attackers trigger zero-click exploits by sending a message containing an image. You don't even need to interact with the message as you would if attackers were trying to make you click a phishing link or download malware -- a zero-click attack works even if you aren't actively handling your phone.