Install the latest operating-system and browser updates offered for your phone. Sekoia’s November 4 report describes three mobile attack chains built from previously patched flaws. The researchers say those observed chains do not work against fully updated devices, which is narrower than a guarantee that an updated phone is immune to spying.
Sekoia, a security research company, published the findings that day. The attackers planted code on websites that checks each visitor's phone and, on an out-of-date one, breaks in without a single tap. Security researchers call this a watering hole attack (the attackers poison sites their targets are likely to visit). Sekoia ties the operation, with moderate to high confidence, to APT29, a hacking group widely attributed to Russia's foreign intelligence service.
Also on November 4, CISA, the US cybersecurity agency, added one of the Apple flaws in the campaign to its catalog of vulnerabilities known to be exploited. That flaw, CVE-2024-27834, was fixed in May 2024.
Hacked sites, lookalikes and a hijacked script
Some legitimate sites were hacked outright, among them a US chemical industry trade association. Others were copied onto lookalike addresses, including a fake version of america250.org, the site for the 250th anniversary of American independence.
The widest net was a hijacked analytics script from Plerdy, a Ukrainian web analytics service. From August 27 to September 3 it carried the attack code onto thousands of websites, most of them Ukrainian. The victims are spread across Europe and the US, with a particular focus on Ukraine.
On an iPhone, the simpler chain takes browser cookies, the files that keep you signed in. The fuller chain can collect messages, mail, chat data, saved passwords, photos, location and Health records. On Android, the reported payload takes Chrome cookies and saved Wi-Fi passwords.
Which phones it targets
The researchers captured three attack chains:
- iPhones on iOS 16.7, with the cookie chain. By Sekoia's analysis it should work on anything from iOS 16.0 to iOS 17.4.
- iPhones on iOS 18.5, with the chain that takes everything.
- Android phones running Chrome 139 through 145. Version 143 was left out, for reasons the researchers couldn't explain.
Both iPhone chains start with the same flaw in WebKit, the engine behind Safari. Apple fixed it in December 2025. The Android chain starts with a Chrome flaw that Google fixed in March 2026.
Checking your version
On an iPhone, open Settings, then General, then Software Update and install the latest supported release. The captured iOS versions identify the attackers’ targeting, not a complete list of vulnerable or safe phones. Follow Apple’s current update guidance rather than treating one old version number as a lasting cutoff.
On Android, update Chrome through Google Play and install the phone maker’s available system security updates. This chain also uses a Qualcomm graphics-driver flaw, so a browser update and a system update address different parts of the attack.
An iPhone that stopped at iOS 16
Apple fixed the flaw CISA just listed on iOS 16 too, in iOS 16.7.8. For the first-step WebKit flaw, Apple lists no iOS 16 release among the fixes.
Do not use the failure of one step in this particular chain as assurance for an unsupported phone. Check which security releases Apple still offers for the model before relying on it for sensitive accounts.
Our take
Install the updates the phone offers and enable automatic updates for the system and browser. For an iPhone left on iOS 16, check whether Apple still offers the fixes it needs. Plan a replacement for an unsupported model before depending on it for sensitive work.
