Watering-hole attacks: how a phone gets hacked by visiting a website

A watering-hole attack works like a poisoned water source: the attacker doesn’t chase you, they wait where you already go. They put attack code on a website people visit, or build a copy of one, and every phone that arrives is looked over and, if it has a weakness, attacked. In early November 2026 the security firm Sekoia described one aimed at iPhones and Android phones, and blamed it on a group linked to Russia.^[1]

Every flaw the group used had already been fixed by Apple and Google, so the attack would not have worked on a fully updated phone.^[2] The phones at risk were the ones nobody had updated: often a parent’s.

What a watering-hole attack is

An ordinary phishing attack needs you to click a link in a message. A watering-hole attack needs only a visit to a page you had good reason to open. The attacker either breaks into a real site and adds code to it, or builds a lookalike that shows the real site’s content while the attack code runs underneath.^[1] The first stage was a script that identified each visitor’s phone and browser, so the attacker’s server could send the attack that matched.^[1]

That matching step is why updates matter so much here. Install the latest available security updates. A newer version is protected only if it includes fixes for the vulnerabilities being exploited.

What Sekoia found

Sekoia attributes the campaign, with moderate-to-high confidence, to APT29, also known as Midnight Blizzard or Cozy Bear, a group widely believed to work for Russia’s foreign intelligence service.^[1][2] Its basis is the similarity to the group’s earlier watering-hole operations, shared infrastructure, and a compromised site that a partner tied to a 2025 APT29 campaign.^[1]

The code turned up on real sites: a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related site.^[1] The Record adds a European political party.^[2] The group also tampered with a script from Plerdy, a Ukrainian analytics service, which was loaded between 27 August and 3 September.^[1] Two lookalike sites copied the America250 site and Raffles London at The OWO, a hotel near the British government. Sekoia’s researchers suggested the first could lure victims with invitations to anniversary events.^[2]

Some of these attacks needed no tap and no download. Visiting the page was enough.^[2]

Which phones were open, and what they gave up

The iOS 18.5 attack used DarkSword, a surveillance toolkit The Record describes as suspected to be commercially developed and earlier used against people in Saudi Arabia, Turkey and Malaysia.^[2] None of the flaws was a zero-day: fixes existed, including for older iOS versions.^[1]

The attacks would not work against fully updated devices.

What is not known

Sekoia hasn’t said how many phones were compromised or how much was taken, and it is unclear whether the group chased particular people or took data from as many vulnerable phones as it could find.^[2] It says the payloads didn’t persist, so restarting a phone stops the activity until the phone meets a poisoned site again.^[1] That is not the same as being safe: what was copied while the phone was exposed stays copied, including cookies and saved logins.

Targets so far appear to be in Ukraine, the US and Europe.^[2] Nothing in these reports says Australian households were singled out. The method is the point: any group can copy it against any phone that is behind on updates.

What to do in ten minutes

1. Update your iPhone. Open Settings, then General, then Software Update, and install what it offers. Turn on Automatic Updates on the same screen.
2. Update Chrome on Android. Open the Play Store, search for Chrome and tap Update if it shows one. Also install any system update under Settings.
3. Do your parents’ phones. This is where the gap usually is. An iPhone that has been left a few versions behind is exactly what this campaign looked for. If a phone can’t go to the newest iOS, check that it has the latest fix for the version it can run: Apple released fixes for older iOS versions too.^[1] See HARD’s alert on the older-iPhone fix.
4. If a phone has been behind for weeks, treat the cookies and saved logins as seen. Change the passwords for your important accounts from a different, trusted device, starting with email and banking. Then use each account’s security settings to sign out all other devices and sessions, so nobody stays logged in.
5. Restart a phone you suspect. A restart stops this campaign’s payloads, though it doesn’t undo anything already taken.^[1]
6. Ask who else is behind. Updates are the one defence every report agrees on. A short family message does more than any app.

For the incident itself, with the versions and sources, see HARD’s alert on the attack. The latest version of iOS and Chrome, and what each release fixes, is on HARD’s updates page. Keeping every family phone current without a weekly nag is a large part of what looking after your parents’ devices means.

Get alerts by emailOnly when something serious happens, with what to do about it. Nothing else, and we never share your address.

Get alerts

See also

• What is a zero-day vulnerability? Plain answers, and what a household should do, a long read
• The TV box botnets: why cheap streaming boxes come pre-infected, a long read
• Russian-linked hackers hit iPhones and Android phones through websites, but only phones missing updates, in the Situation Room
• Apple brings its fix for an exploited flaw to the iPhone XS, XS Max, XR and seventh-generation iPad, in the Situation Room
• Latest versions of iOS, Chrome and more, what each security release fixes, and how to install it
• Look after your parents, keeping their phones updated on the Family plan
• Every long read, by topic and by date

References

1. ^ BleepingComputer. “Hackers use n-day exploits in zero-click attacks on iOS, Android devices”, Nov 2026.Sekoia's findings: the attribution, the compromised and lookalike sites, the iOS and Chrome versions targeted, what each chain took, and that nothing persisted.
2. ^ The Record. “Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign”, Nov 2026.The same report with more on the targets, the DarkSword toolkit, the Plerdy script and what Sekoia doesn't know.

Sources checked 6 November 2026. Sekoia's report itself was read through these two articles, not directly. They agree on the attribution, the versions and that every flaw was already fixed. They differ on the scale of the Plerdy script: BleepingComputer says thousands of sites loaded it, The Record says hundreds of sites were exposed through it, so this article says only that it was widely loaded. Sekoia's attribution to APT29 is its own assessment.