Zero-Click Exploit on iOS and Android: Russian Watering Hole Attacks Hacked Out-of-Date Phones Through Ordinary Websites, and the Versions to Check

Security researchers at Sekoia say Russian state hackers planted hidden code on real websites and fake copies of real websites, so that iPhones and Android phones running old software were broken into just by loading a page. If your staff use phones for work email, chat or company logins and some of those phones are behind on updates, training will not stop this attack, because there is nothing to click.

The good news: every flaw used had already been fixed by Apple and Google. Phones that were up to date were not at risk from these attack chains.

What happened in the zero-click watering hole attack

On November 4, 2026, Sekoia's threat research team (TDR) published a report called "Poisoned Source". It describes a campaign the team found in mid-October 2026. A watering hole attack means the attacker does not go after you directly. They compromise websites they expect their targets to visit and wait.

According to Sekoia, the attackers broke into or imitated these sites:

• Real sites they broke into: a Ukrainian gas production company, a major US chemical-industry trade association, a far-right European political party, a far-right Czech movement's website and a Bulgarian military-related website.
• Lookalike sites: america250[.]holiday, which relayed the real America250.org content, and theowo[.]club, which relayed the site of the Raffles London at The OWO hotel. Because the fakes passed real content through, visitors would have seen what looked like the genuine site.
• A supply chain compromise: the SEO tracker of Plerdy, a Ukrainian web analytics service, was tampered with for one week, August 27 to September 3, 2026. Sekoia says thousands of websites load that tracker, most of them Ukrainian, including military-related ones.

The hidden script first checked the visitor's device and browser version. The attackers' server then sent an exploit chain built for that exact phone. Sekoia says the delivery happens "without user interaction."

Which iPhone and Android versions were targeted

Sekoia describes three exploit chains. All of them use known, already-patched flaws (n-days), not zero-days.

Sekoia also notes that chain C skips one phone model, the Galaxy S25 Ultra (SM-S938B).

What is confirmed, what is claimed and what is not known

Confirmed by the vendors. Apple's iOS 26.2 notes, released December 12, 2025, list CVE-2025-43529 and CVE-2025-14174 in WebKit, the engine behind Safari. Apple says it is aware of a report that the issues "may have been exploited in an extremely sophisticated attack" against specific people on versions of iOS before iOS 26. Apple's iOS 26.3 notes, released February 11, 2026, list CVE-2026-20700 in dyld with the same warning.

Google's Stable Channel desktop update of March 12, 2026 (Chrome 146.0.7680.75/76) fixed CVE-2026-3910, a high severity V8 flaw, and says "Google is aware that an exploit for CVE-2026-3910 exists in the wild." Google's Chrome for Android update the same day, version 146.0.7680.115, says Android releases contain the same security fixes as the matching desktop release. The Qualcomm display flaw CVE-2025-27038 is in Android's August 2025 security bulletin, fixed at patch level 2025-08-05.

Claimed by the researchers. Sekoia says, with moderate to high confidence, that APT29 (also called Midnight Blizzard or Cozy Bear, which Sekoia links to Russia's SVR foreign intelligence service) is behind the campaign, or at least one of its subgroups. That rests on similarities to earlier APT29 watering hole operations and on shared infrastructure. It is an assessment, not a confirmed fact.

Not known.

• How many phones were actually compromised. Sekoia does not give a victim count.
• Why some sites were chosen. Sekoia says the value of some of them is unclear, and that an Australian medical clinic was among the unrelated victims, which "complicates a broad strategic interpretation." So this may not be limited to the obvious government and defense targets.
• What happens after a restart. Sekoia says the final payloads work "without establishing persistence." It does not explain what that means in practice for a rebooted phone. Either way, data that has already been sent to the attackers stays with them.
• Older iPhones. We could not confirm from Apple's notes that every flaw in the iOS 16 chain has been fixed on the iOS 16 line.

Why this matters for a business network

This was not about shady websites. The real sites in this campaign were the kind of places people visit for work: an industry trade association, an energy company, analytics code embedded across thousands of ordinary sites.

What was stolen is what lets an attacker log in as your staff. Browser cookies can hold signed-in sessions, which may get past passwords and MFA codes until the session ends. Saved Chrome logins and Keychain items hold passwords. Saved Wi-Fi passwords include your office network. On a personal phone used for work (BYOD), all of that sits next to company email and chat.

The only defense that mattered here was the update level on the phone. Sekoia puts it plainly: "a user running an up-to-date operating system is safe from these attacks."

What to do this week

Then:

1. Set a minimum OS rule. If you use device management, block company email and apps on phones below the versions above. If you do not, ask staff for a screenshot of their About screen.
2. Find the stragglers. Phones that cannot update any further are the ones these chains were built for. Replace them or take them off company accounts.
3. If a phone was out of date and used on the affected sites, sign that user out of all sessions in Microsoft 365 or Google Workspace, change passwords saved on the phone, and change the office Wi-Fi password.
4. Read the related updates: our posts on the iOS 27.2 security update, the Android security update for November 2026 and Chrome 156 and Firefox 159.

Zero-click exploit questions people are asking

What is a zero-click exploit?

An attack that needs no tap, download or permission from the victim. In this campaign, simply loading an infected web page was enough.

Can a website hack my phone just by visiting it?

Only if the phone has an unpatched flaw the site can use. Every flaw in this campaign was already fixed, so phones that were up to date were safe from it.

Is my iPhone safe if it is up to date?

From these chains, yes. Sekoia says an up-to-date operating system is safe from these attacks.

Does restarting my phone remove the malware?

Sekoia says the payloads do not establish persistence, but it does not describe restart behavior. A restart does not get back data already stolen. Updating is the fix.

What is an n-day exploit?

An exploit for a flaw that has already been made public and patched. It works on anyone who has not installed the fix.

Who is behind the watering hole attack?

Sekoia assesses with moderate to high confidence that it is APT29 or one of its subgroups. Neither Apple nor Google has named the attacker.

The bigger lesson

Attackers keep using flaws that were fixed months ago because they know a share of phones never gets updated. The fix is out, so the risk now comes down to which of your devices are still behind, and whether anyone is checking.

If you want help putting minimum version rules and device checks in place, see security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Sekoia TDR, Poisoned Source report; Apple, iOS 26.2 security content; Apple, iOS 26.3 security content; Apple security releases; Google, Chrome Stable Channel Update for Desktop, March 12, 2026; Google, Chrome for Android Update, March 12, 2026; Android Security Bulletin, August 2025.