Other cyber events · Developing
Fake copies of trusted websites tried to infect phones. An update stops it
Researchers linked a large spying operation to Russian intelligence. It attacked phones with old software through real and fake websites. Updates keep the phone safe from these attacks.
What happened
Security researchers at the company Sekoia published a report on November 4, 2026, about a large spying operation.
The attackers broke into trusted websites. They also built fake copies of two real websites.
One fake copy looked like the site of America250, a United States anniversary project. The other copied a famous London hotel.
The attackers also hid their code inside Plerdy, a visitor-counting tool loaded by thousands of websites, most of them Ukrainian.
That hidden code ran on the affected websites from August 27 to September 3, 2026.
A visitor opened a page. Hidden code read the device and sent an attack made for it.
The visitor does not tap anything and does not install anything. Researchers call this a zero-click attack.
Security researchers call this whole trick a watering-hole attack. The attacker poisons a place that many people already trust.
Sekoia links the operation to APT29, a spy group tied to Russian intelligence.
The evidence for the link is strong, but Sekoia is not completely sure.
On some phones, the attack copied saved website sign-ins. On others, it copied far more data.
On newer iPhones, it copied message records, saved passwords, location history, photos, and files kept in iCloud Drive.
On Android phones, it copied Chrome sign-ins, browsing history, and saved Wi-Fi passwords.
Sources: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits; Hackers use n-day exploits in zero-click attacks on iOS, Android devices
Who’s affected
This report concerns people who browse on a phone with old software.
An iPhone with iOS 16.0 to 17.4 can lose its saved website sign-ins. The published attack targets iOS 16.7 phones.
An iPhone on iOS 18.5 can lose much more. The stolen data includes message records, saved passwords, location history, photos, and iCloud Drive files.
An Android phone can lose its Chrome sign-ins, browsing history, and saved Wi-Fi passwords.
The Android attack works on Chrome versions 139 to 145, except version 143.
A phone with the latest updates is safe from these attacks. The makers fixed every problem before the attacks started.
The attack copies data and leaves nothing behind on the phone. A restart ends anything still running.
Sources: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits; Hackers use n-day exploits in zero-click attacks on iOS, Android devices
What to do
- Open Settings, then General, then Software Update on your iPhone.
- Install any update the phone offers.
- Turn on automatic updates in the same place. The phone then installs future fixes by itself.
- On an Android phone, open the Play Store and search for Chrome.
- Install any update the store offers for Chrome.
- Restart the phone after the updates finish.
- If your phone had old software, sign out and back in to your email and bank.
- Do the same for any other account you use in the phone's browser.
- Sign out to end the old session. The copied sign-in then stops working.
- Turn on automatic app updates in the Play Store or the App Store.
- Check the web address before you sign in anywhere. A fake address that looks almost right is a warning sign.
- If your website loaded Plerdy between August 27 and September 3, 2026, review that code.
Sources: Update iOS on your iPhone; Update apps on Android; Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
What we do not know yet
Sekoia links the operation to the Russian spy group with moderate-to-high confidence. The link is not certain.
Sekoia does not publish a count of the people the attackers hit. Its team works with national response teams to find that number.
We do not know whether any particular reader's phone was hit.
Sekoia does not say why the attack skipped Chrome version 143.
Sources: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
