Hacked Websites Targeted Old Phones: Update iPhone and Android Now

Researchers found hacked and copycat websites that attacked out-of-date phones. Apple and Google have fixed the flaws, so update and restart today.

Security researchers found hacked websites that quietly attacked iPhones and Android phones that were not up to date. Apple and Google have already fixed every flaw used. So the most important step is simple: install the latest updates on your phone and restart it today.

What happened

The security company Sekoia spotted the operation in mid-October 2026, as Help Net Security reports. Sekoia links it, with moderate to high confidence, to a group called APT29. The group is also known as Midnight Blizzard or Cozy Bear. It is tied to Russia's Foreign Intelligence Service.

This kind of attack is called a "watering hole." The attacker does not chase you. Instead, they set a trap on websites they expect certain people to visit. It is like a hunter waiting at a watering hole.

According to BleepingComputer, the sites were in the U.S., Ukraine, the Czech Republic and Bulgaria. They included:

• Real websites that were broken into. These included sites of a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related group.
• Lookalike websites that copied the official America250 site and the Raffles London at The OWO hotel site. They showed the real pages, so they looked normal.
• A Ukrainian web analytics service called Plerdy. Its tracking code runs on thousands of websites, mostly in Ukraine. Attackers used it to spread their code between August 27 and September 3, 2026.

How the trick works

Every trap started the same way. A small hidden script checked what phone and browser each visitor used. A browser is the app you use to open websites, like Safari or Chrome.

Then the site sent an attack built for that phone. The researchers say this happened "without user interaction." That means you did not have to tap a link, open a file or type anything. Loading the page was enough.

The attacks used "n-day" flaws. An n-day flaw is a weakness that is already known and already fixed. It only works on phones that have not installed the fix yet. That is why updates matter so much here.

Here is what the researchers say the attacks went after:

• iPhones on iOS 16.7: cookies. Cookies are small files that keep you logged in to websites. With them, attackers could reuse your logged-in session and get into services like webmail.
• iPhones on iOS 18.5: almost everything on the phone. This includes texts, iMessage, WhatsApp and Telegram data, saved passwords in Keychain, location, health information and photos.
• Android phones running Chrome versions 139 through 145, except 143: these were attacked through a flaw in Chrome.

Help Net Security also reports that the operation aimed to steal messages and Wi-Fi passwords.

Who is at risk

Many of the sites were likely to draw important visitors connected to the war between Russia and Ukraine. Researchers believe the hotel copy may have been meant for diplomats and well-known guests.

Still, not every site fit that pattern. One belonged to an Australian medical clinic. Researchers say, with low confidence, that sites like that may have been used to go after specific people. They also say it is unclear whether the attackers wanted certain visitors, or wanted to reach as many out-of-date phones as possible.

So the plain answer is this. Most people were not the main target. But any phone that is not up to date carries more risk, because known flaws are easier to use.

How to stay safe

1. Update your phone. BleepingComputer says Apple and Google have patched all the flaws used in this campaign. The fixes even reached older iOS versions. On iPhone, open Settings, then General, then Software Update. On Android, check Settings for a system update.
2. Update Chrome. On Android, open the Google Play Store, find Chrome and tap Update if you see it.
3. Turn on automatic updates. This way, fixes arrive without you having to remember.
4. Restart your phone. Sekoia found the attack code did not stay after a restart. The harmful activity stopped until the person visited a trapped site again.

What to do if you think you were hit

You may not know for sure, because these attacks were built to be quiet. If your phone was out of date and you visited sites linked to Ukraine, the military or the groups named above, these steps are a sensible start:

• Update your phone and browser first. Then restart.
• Sign out of your email and other important accounts on all devices, then sign back in. This can help cut off old logged-in sessions.
• Change the passwords for your email and any accounts saved on the phone. Start with email.
• Change your home or office Wi-Fi password.
• Turn on two-step login where it is offered. This means you enter an extra code when you sign in.
• If you work for a group linked to these topics, tell your IT or security team.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Russian hackers target iOS and Android users with n-day exploits, Help Net Security, 2026-11-04
• Hackers use n-day exploits in zero-click attacks on iOS, Android devices, BleepingComputer, 2026-11-04