Update your iPhone and Chrome: Russia-linked attacks hit outdated phones through real websites

The skim

• What to do: update your iPhone (Settings > General > Software Update) and update Chrome on Android from the Play Store. Security firm Sekoia says none of these attacks work against fully updated devices.
• Sekoia says a hacking campaign it calls "Poisoned Source," which it ties to Russia-linked APT29 with "moderate to high confidence," planted exploit code on real websites, lookalike sites and a hijacked web analytics script.
• Visitors on older iOS versions or older Chrome on Android could have cookies, logins, Wi-Fi passwords or, on some iPhones, far more data stolen just by loading a page.

What to do right now

• iPhone: go to Settings > General > Software Update and install whatever is offered. Our new guide walks through it: How to update your iPhone to the latest iOS version.
• Android: open the Play Store, tap your profile icon, tap Manage apps & device and update Chrome. Then check for a system update with our guide: How to check your Android security update.
• Restart your phone. Sekoia says the malware doesn't survive a reboot.
• If you used an old device recently, sign out of important accounts on other devices and change key passwords, since stolen cookies can keep you logged in elsewhere.

What happened

French security firm Sekoia published research on Nov. 4 describing a "watering hole" campaign. That's an attack where hackers booby-trap websites their targets are likely to visit, then wait. The code checks each visitor's phone and serves an exploit only to devices it can break into.

Sekoia found three ways the code reached people. Some legitimate sites were compromised. Others were lookalike domains set up by the attackers. The biggest channel was the Plerdy SEO Tracker, a third-party analytics script that was hijacked from Aug. 27 to Sept. 3, 2026, putting the attack code on thousands of sites that used it, mostly in Ukraine, according to Sekoia.

Sekoia describes three exploit chains, all for older software:

• iOS 16.7: steals browser cookies.
• iOS 18.5: uses an exploit chain called DarkSword that can pull messages, WhatsApp and Telegram data, Keychain passwords, photos, location and Health data.
• Chrome 139 through 145 on Android, except 143: steals Chrome cookies, saved logins and browsing history, plus saved Wi-Fi passwords.

The key line from Sekoia's report: "None of them contain zero-days or work against fully updated devices." It adds that "a user running an up-to-date operating system is safe from these attacks." BleepingComputer and The Hacker News also reported the findings and note that Apple and Google have already patched the flaws, including fixes for older iOS releases.

Why it matters

You didn't have to click anything suspicious. Just loading an ordinary-looking web page on an out-of-date phone was enough. These are "n-day" bugs, meaning fixes already exist. The attack only works on phones that haven't installed them, which is why the advice is so simple.

The campaign appears focused on Ukraine, but compromised analytics scripts can show up on sites anywhere. The safest phone is an updated one.

Sources: Sekoia, BleepingComputer, The Hacker News, Google Chrome Help.