APT29 Mobile Exploits Hit iPhone and Android: Check Your Updates Now

Russia-linked hackers have been using APT29 mobile exploits to break into iPhones and Android phones through ordinary websites, according to new research from Sekoia. The good news: every flaw they used already has a patch, so an up-to-date phone is safe. The bad news is that plenty of phones aren’t up to date.

Here are the key facts before we get into the details.

• The campaign is called “Poisoned Source” and was spotted in mid-October 2026.
• It targets iOS 16.7, iOS 18.5, and Android phones running Chrome 139 to 145.
• Visiting an infected website is enough. No download or tap is needed.
• Sekoia says all the exploited bugs were fixed before the attacks began.
• CISA added one of the iOS flaws to its Known Exploited Vulnerabilities list on November 4.

If you only do one thing, update your phone’s OS and browser today.

How the APT29 mobile exploits work

This is a “watering hole” attack. Instead of emailing victims, the attackers plant malicious code on websites their targets already visit. When someone opens the page, the code checks the phone and quietly fires the matching exploit.

Sekoia found three ways the code spread: JavaScript injected straight into legitimate sites, lookalike domains copying well-known pages, and a supply-chain hit on Plerdy, a Ukrainian web analytics service. The Plerdy script was compromised between August 27 and September 3, 2026, according to The Hacker News.

That last route matters because one poisoned script can reach thousands of sites at once. Most of the affected sites were Ukrainian, including military-related ones.

Which phones and versions were targeted

The attackers sorted visitors into three groups based on their device and software version. Each group got a different exploit chain.

Sekoia also noticed the Android chain skips the Galaxy S25 Ultra, though it didn’t explain why. See Help Net Security for the full breakdown.

Why “n-day” exploits are still dangerous

These were n-day exploits, meaning bugs that already have fixes. Attackers use them because they are cheaper than zero-days, and they work on anyone who delays updates.

That’s the real lesson here. A patch only protects you once it’s installed. Old iPhones that can’t run the latest iOS, or Android phones that stopped getting security updates, stay exposed.

CISA added CVE-2024-27834 to its catalog on November 4 and told US federal agencies to patch by November 18. That gives you a sense of how seriously it takes the issue.

Who is behind it, and should you worry?

Sekoia attributes the campaign to APT29, also known as Midnight Blizzard or Cozy Bear, a group tied to Russia’s foreign intelligence service. Sekoia rates that attribution as moderate-to-high confidence, so treat it as likely, not proven.

Known targets include a Ukrainian gas company, a US chemical industry trade group, a European political party, and a Bulgarian military-related site. Sekoia says it can’t tell whether the aim was specific people or mass infection.

For most readers the risk is low. But a poisoned analytics script can sit on any site, so the safest move is simply to stay patched. We covered the latest Android fixes in our November 2026 Android security update guide, and Apple’s own warnings in our post on Apple threat notifications.

How to protect your phone right now

These steps take about five minutes and cover all three attack chains.

1. On iPhone, go to Settings, General, Software Update and install the newest iOS available for your model.
2. On Android, open Settings, System, System update and install any pending patch.
3. Update Chrome from Google Play, and restart it afterward.
4. If your phone no longer gets updates, avoid logging into email or banking on it.

If you think you visited a suspicious site on an old device, sign out of important accounts and change your passwords from a clean, updated device. Also change saved Wi-Fi passwords.

Frequently Asked Questions

Can I get infected just by visiting a website?

Yes, on an unpatched phone. These chains run when the page loads, with no tap or download needed. A fully updated phone is not vulnerable to the flaws used here.

Is my iPhone safe if I run the latest iOS?

According to Sekoia, yes. The exploits only targeted iOS 16.7 and iOS 18.5, and all the flaws were fixed before the campaign began.

Does this affect Samsung phones?

Android phones with Chrome 139 to 145 were targeted. The chain reportedly skipped the Galaxy S25 Ultra, but that is no reason to delay updating.

What is a watering hole attack?

It’s when attackers infect a site their targets are likely to visit, then wait. It avoids phishing emails entirely, which makes it harder to spot.

How do I know if my phone was compromised?

Sekoia hasn’t published detailed detection steps for regular users. If you suspect a problem, update the phone, change your passwords, and consider a factory reset.

Our take

This campaign is a reminder that update prompts aren’t nagging, they’re the defense. If you’ve been putting off an iOS or Chrome update, do it tonight, and retire any phone that no longer gets security patches from anything sensitive.