Russian hackers are hitting unpatched iPhones and Android phones through websites: update now
Researchers say Russia-linked APT29 used compromised websites to attack iPhones and Android phones with old, already-fixed flaws. An up-to-date phone is safe. Here's how to check.
A new report shows that a phone you forgot to update can be hacked just by visiting a website. Security firm Sekoia says Russia-linked hackers known as APT29 have been using compromised websites to attack iPhones and Android phones that have not installed security updates. The good news is that every flaw used had already been fixed. Here is what happened and how to protect yourself.
What happened?
Sekoia’s researchers spotted the campaign in mid-October 2026. They say, with moderate to high confidence, that it is linked to APT29, also called Midnight Blizzard or Cozy Bear, a group tied to Russia’s Foreign Intelligence Service.
The attackers used a “watering hole” technique, which means planting malicious code on websites their targets are likely to visit. According to the report, they used three methods:
- Hacked legitimate websites with malicious JavaScript added.
- Lookalike domains that loaded real pages while adding the attack code.
- A hijacked analytics service: the Ukrainian tool Plerdy was used to serve the code through its tracking script between August 27 and September 3, 2026. That script runs on thousands of websites, mostly Ukrainian.
Compromised sites included a Ukrainian gas company, a US chemical industry trade association and a Bulgarian military-related organization. Lookalike domains imitated a US 250th anniversary site and a London luxury hotel. The campaign appears centered on Ukraine, but it is unclear whether the attackers targeted specific visitors or tried to infect as many unpatched devices as possible.
How did the attack work?
The malicious code profiled each visitor’s browser and device, then served an exploit chain matched to it. Visiting the page was enough, with no downloads or taps needed.
- iPhones on iOS 16.7: the attackers stole cookies, which can let them reuse logged-in sessions such as webmail.
- iPhones on iOS 18.5: a chain built on the DarkSword exploit kit could take almost everything on the phone, including messages from SMS, iMessage, WhatsApp and Telegram, Keychain passwords, location data, health information and photos.
- Android phones with Chrome versions 139 to 145 (except 143): the attackers stole Chrome cookies, saved logins, browsing history and Wi-Fi passwords.
According to the report, the malware does not install anything that stays on the phone after it sends the data out.
Is my phone safe?
Sekoia stressed that every flaw used had been fixed before the campaign began, and that “a user running an up-to-date operating system is safe from these attacks.” So the risk is mostly for people who have not updated, or whose phones no longer get updates.
Researchers also warn that packaged exploit kits make advanced attacks cheaper and easier, and expect state-backed groups to reuse them more often.
How to protect yourself today
- Update your iPhone. Go to Settings > General > Software Update. Our guide to iOS 27.2 explains what is in the latest version.
- Update Android and Chrome. Install the latest Android security update, and update Chrome from the Google Play Store.
- Turn on automatic updates for your operating system and browser.
- Check if your phone is still supported. Some older iPhones, such as the iPhone 8 and iPhone X, stopped at iOS 16, and many older Android phones no longer get patches. Consider replacing a phone that can’t update.
- Log out of sensitive accounts if you suspect a problem, and change important passwords. Our 10-minute checklist shows how.
- High-risk users such as journalists, activists and officials can turn on Apple’s Lockdown Mode.
Should most people worry?
This campaign seems aimed mainly at targets linked to the Russia-Ukraine war, and most people are unlikely to be the intended victims. Still, the lesson applies to everyone: attackers often use old flaws because many phones are never updated. Installing updates is the single best defense.
Frequently asked questions
Who is APT29?
APT29, also known as Midnight Blizzard or Cozy Bear, is a hacking group linked to Russia’s Foreign Intelligence Service.
Can I be hacked just by visiting a website?
If your phone is missing security updates, yes. In this campaign, visiting a compromised page was enough to trigger the attack on unpatched devices.
Are fully updated phones affected?
Sekoia says a phone running an up-to-date operating system is safe from these specific attacks.
What data did the attackers steal?
Depending on the phone, cookies, messages, Keychain passwords, location data, photos, saved logins and Wi-Fi passwords.
