syslog.eu
CS EN DE FR
[WARNING · CHECK THIS WEEK]/News·

Hacked websites hit out-of-date iPhones and Android phones – update your staff's phones

Security firm Sekoia says APT29, a group widely linked to Russia's foreign intelligence service, planted attack code on hacked websites and lookalike domains. On iPhones and Android phones with outdated software, opening an affected page was enough: the exploit chains needed no further interaction. Sekoia, which found it in mid-October, attributes it with moderate to high confidence. Apple and Google had already patched every flaw it used.

Affected android chrome ios
Syslog card, level WARNING (check this week): Outdated phones hit, just opening a hacked web page was enough. Affected: iOS, Android, Chrome. To do: Update iOS, Android and Chrome on phones; Find phones stuck on old iOS or Android.

Does this concern you?

  • Affected: any company whose staff use iPhones or Android phones that are not on the latest update – company phones and personal ones with work mail or chats.
  • Also: companies whose website loads third-party scripts such as analytics trackers; one provider, Plerdy, was hijacked to serve the attack code.
  • Skip it if: every phone that touches work data has the latest update it is offered, and Android phones the latest Chrome.

What to do

  • On iPhones, install the latest iOS update the device is offered; on Android, update both Chrome and the operating system. Apple also fixed the flaws in older iOS versions.
  • Find the phones left behind: in device management or by asking staff.
  • For the named flaws, the fixes are iOS 18.7.3 or 26.2 (December 2025), Chrome 146.0.7680.75 (March 2026) and a Qualcomm graphics driver fix (June 2025). Older versions still had these flaws.
  • A phone that was outdated since at least late August (the earliest reported date): the payloads did not stay on the device, and a restart stops them until the next visit to an infected page. Stolen session cookies, though, let an attacker reuse logins such as webmail. In our view, sign out all sessions of the work accounts used on it and change the passwords saved there.
  • Your website, in our view: know which third-party scripts it loads, and drop those you no longer use.

What we know – and what we don't

  • Hacked sites included a Ukrainian gas producer, a US chemical industry trade association, a Czech political movement and a Bulgarian military-related organization; Plerdy's SEO tracker was modified between August 27 and September 3.
  • Sekoia recovered three chains: iOS 16.7 (browser and some app cookies); iOS 18.5 using the DarkSword exploit kit (iMessage, WhatsApp and Telegram databases, Keychain credentials, location, photos); Android, a Chrome flaw (CVE-2026-3910) with an Adreno driver flaw (CVE-2025-27038), collecting Chrome cookies, logins, history and saved Wi-Fi passwords. CVE-2025-43529 is linked to DarkSword.
  • CISA lists all three CVEs as exploited; it added them between June 2025 and March 2026.
  • Not known: how many people were hit. The Czech movement is not named. Sekoia is working with national incident response teams to identify victims.

Why it matters

No link to click, no app from outside the store: an outdated phone and one visit to a trusted site were enough. The fixes exist; the risk is the phone nobody updated.

Sources

← All news