Russia-linked hackers infected unpatched iPhones and Android phones through hacked websites

Hackers linked to Russia have been infecting iPhones and Android phones through ordinary websites: opening an infected page on an outdated phone was enough, with no further taps or downloads. Researchers at the French security firm Sekoia, who spotted the campaign in mid-October, attribute it with "moderate to high confidence" to APT29, a group tied to Russian intelligence and also known as Midnight Blizzard, according to their report published on 4 November. Every flaw used in the attacks had already been fixed by Apple and Google before the campaign began, so the victims are people who did not update their phones.

Real websites as bait

This kind of attack is called a watering hole: instead of sending a malicious link, the hackers wait on sites their targets visit anyway. Sekoia found malicious code injected into the sites of a Ukrainian gas producer, a US chemical industry trade association, a Bulgarian military-related site, a far-right European political party, a Czech far-right movement and an Australian medical clinic.

The attackers also built copies of two real sites that relayed the original content. One imitated America250, the official site of the US 250th anniversary celebrations. The other copied the website of the Raffles London at The OWO hotel, which Sekoia believes was aimed at diplomatic delegations and high-profile guests.

The widest net came from a supply-chain attack. From 27 August to 3 September, the tracking script of the Ukrainian web analytics service Plerdy was modified to load the attackers' code. Sekoia says this script runs on "thousands of websites, the large majority of them Ukrainian", so anyone who opened one of those sites from a vulnerable phone during that week could have been exposed.

What the attack took from phones

A script on the page first fingerprinted the device and browser, then the attackers' server sent an exploit chain matching the phone. Sekoia describes three chains:

• iOS 16 and early iOS 17: stole cookies from Safari and apps, which can let an attacker get into accounts without a password.
• iOS 18.5: took almost everything: SMS, iMessage, WhatsApp and Telegram messages, passwords from the Keychain, mail, contacts, call history, notes, location data, Health data, photos and iCloud Drive files.
• Android, Chrome versions 139 to 145 (except 143): stole Chrome cookies, saved logins, browsing history and saved Wi-Fi passwords.

The iOS 18 chain overlaps with DarkSword, an iPhone exploit kit that Google, iVerify and Lookout described in March and that several groups, including spyware vendors, have used since at least November 2025. Sekoia thinks the exploits probably came from a commercial surveillance vendor's kit.

None of the payloads stayed on the phone: a restart ends the infection until the device visits an infected page again, BleepingComputer notes. But data copied before the restart is already gone.

Who was the target

APT29 usually goes after governments, diplomats and defence targets, and the list of sites fits that pattern. Sekoia says, however, that "it remains unclear" whether the hackers were after visitors of specific sites or simply any unpatched phone they could reach. Unlike a similar APT29 campaign in 2024, this one had no filter and collected cookies from any browser. Its operators keep looking for new ways into devices: in August, Microsoft reported that a subgroup of the same group hijacked hotel Wi-Fi login pages to push malware disguised as a browser update.

How to protect your phone

• Install the latest iOS or Android update. Sekoia says that "a user running an up-to-date operating system is safe from these attacks". If your iPhone cannot get the newest iOS, install the latest update Apple offers for it: some fixes were backported to older versions.
• On Android, update Chrome separately in Google Play, as the browser is where the attack starts.
• If your phone was outdated and you visited Ukrainian sites in late August or early September, sign out of all sessions in your main accounts and change important passwords: stolen cookies stay valid until you do.
• A restart ends this particular infection, but it does not close the holes and does not bring back stolen data, so it is no substitute for updating.
• A VPN does not help here: the malicious code arrives from real websites over ordinary encrypted connections, and a VPN only changes the route your traffic takes.
• If you are a journalist, official or activist, turn on Lockdown Mode on your iPhone. Apple recently warned German MPs that their phones were targeted by spyware.