Malware · medium
Russia-linked hackers use watering-hole sites to deliver iOS and Android exploit chains
Tier A · Patch today – Before you go home
Who’s exposed: iOS and Android users visiting compromised or fake sites
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Remote, no login · Full takeover
The Brief
- A large-scale watering hole attack associated with Russian hackers targets iOS and Android users visiting compromised or fake sites.
- Attackers exploit previously patched iOS and Android flaws, so unpatched devices remain vulnerable.
- CISA added a medium-severity flaw affecting multiple Apple operating systems to its Known Exploited Vulnerabilities catalog after reports of active exploitation.
Why it matters
Patched flaws are still being used against unpatched phones, so developers and their teams need to keep mobile devices updated, including test and admin devices.
The checklist behind the tier
Checklist · 5 of 10 yes
| Yes | Hits tech teams | Judgment: iOS and Android are operating systems developers and IT teams work on and run. |
| No | Core infrastructure | Judgment: mobile OS flaws are not in the core infrastructure list like Linux, OpenSSH or OpenSSL. |
| Yes | Popular tool | Judgment: iOS and Android are widely used mainstream operating systems. |
| Yes | Exploited in the wild | The Hacker News: CISA added the Apple flaw to KEV after reports of active exploitation. |
| No | Public exploit | No source says exploit code or a proof-of-concept was published. |
| Yes | Remote, no login | BleepingComputer: hackers use n-day exploits in zero-click attacks on iOS and Android devices. |
| Yes | Full takeover | Ars Technica: hackers exploited the flaws to infect phones with malware. |
| No | Secrets exposed | Sources say info-stealing malware was delivered; none report stolen credentials or data. |
| No | Supply chain | Malware was delivered via compromised or fake websites, not a trusted package, update or pipeline. |
| No | No fix yet | The Hacker News and Ars Technica describe the flaws as previously patched. |
Timeline
Researchers report the watering hole attacks exploiting patched iOS and Android flaws
CISA adds the medium-severity Apple flaw to its Known Exploited Vulnerabilities catalog
BleepingComputer
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
The Hacker News
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
Biz & IT - Ars Technica
Hackers exploited iOS and Android flaws to infect phones
The Hacker News
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
SecurityWeek
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
The Record from Recorded Future News
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Full coverage · 6 sources
- 22h ago ↗
The Record from Recorded Future News
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - 1d ago ↗
- 1d ago ↗
- 2d ago ↗
Biz & IT - Ars Technica
Hackers exploited iOS and Android flaws to infect phones - 2d ago ↗
- 2d ago ↗
First seen · 6 sources · Full story page · How tiers are decided