Hackers Target iPhones and Android Phones: Here’s What We Know

Your phone could be compromised simply by visiting a legitimate website that hackers have secretly infected.

On Nov. 4, 2026, cybersecurity firm Sekoia disclosed a campaign that exploited previously patched vulnerabilities in iPhones and Android devices to steal passwords, browser cookies, messages, and other sensitive information via compromised websites.

The attacks could begin automatically when vulnerable devices loaded affected webpages, without additional clicks or downloads. For employees using smartphones to access work accounts, stolen credentials and browser sessions could also expose corporate information.

How hackers turned legitimate websites into traps

The campaign, dubbed Poisoned Source, was discovered by Sekoia researchers in mid-October 2026. The company published its findings on Nov. 4, detailing how attackers turned trusted websites into delivery mechanisms for mobile exploits.

Sekoia attributed the operation with moderate-to-high confidence to APT29, also known as Midnight Blizzard, a Russian-linked cyberespionage group.

Attackers used three methods to reach potential victims:

• Compromised websites: Hackers inserted malicious JavaScript into legitimate websites, including those associated with organizations in the US and Europe.
• Fake websites: Attackers created lookalike domains that relayed content from legitimate websites while injecting malicious code into visitors’ browsing sessions.
• Hijacked analytics software: Attackers injected malicious code into a legitimate Plerdy analytics tracking script hosted at a.plerdy.com. Websites loading the affected script could expose their visitors to the attackers’ malicious code.

When someone visited an affected webpage, the malicious code checked the device’s operating system and browser version. If it identified a vulnerable configuration, it could attempt to launch an exploit designed for that device.

The attacks required victims to visit a compromised or attacker-controlled website, but no further interaction was necessary for exploitation to begin.

Researchers have not confirmed how many devices were successfully compromised.

Which iPhones and Android devices were targeted?

Researchers identified three exploit chains targeting specific outdated iOS and Android configurations. The versions below describe configurations observed or identified during the investigation, rather than all potentially vulnerable software releases.

The iOS 16.7 configuration was observed in the campaign, although exposure on other iOS versions depends on the vulnerabilities present and installed security updates.

The iOS 18.5 attack used the DarkSword exploit kit to target vulnerable iPhones. According to researchers, the payload could steal WhatsApp and Telegram databases, iCloud Keychain credentials, photos, and location information.

TechRepublic previously reported on the DarkSword iPhone threat and Apple’s subsequent emergency security response.

For Android users, the attackers deployed a data-stealing payload called AndroSnitch. The exploit chain involved two vulnerabilities:

• CVE-2026-3910: A vulnerability affecting Google Chrome.
• CVE-2025-27038: A vulnerability affecting Qualcomm graphics drivers.

The campaign relied on previously patched vulnerabilities rather than newly discovered flaws. According to The Hacker News, Sekoia reported that devices running current security updates were protected against the documented exploit chains. That does not guarantee protection against every mobile security threat.

CISA issues warning about exploited Apple vulnerability

On Nov. 4, the US Cybersecurity and Infrastructure Security Agency added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog. Sekoia identified the same flaw in the Poisoned Source campaign, although CISA did not independently attribute the exploitation to APT29.

The vulnerability could allow attackers with existing arbitrary read-and-write capabilities to bypass Apple’s Pointer Authentication security protection. Apple patched the flaw in May 2024, including through iOS 16.7.8 and iOS 17.5. Fixes were also released for affected versions of other Apple operating systems and Safari.

CISA set a Nov. 18, 2026, remediation deadline for covered federal civilian agencies.

Although that deadline does not apply to individual iPhone owners, the agency’s listing confirms that attackers have exploited the vulnerability in real-world attacks.

How to protect your iPhone or Android device

The good news is that the documented attacks relied on vulnerabilities for which security fixes were already available. That makes updating devices and browsers the most important immediate precaution.

Here’s what users should do:

• Update your iPhone: Open Settings > General > Software Update and install available updates.
• Update Android and Chrome: Install Android system, security, and manufacturer updates, then update Chrome through Google Play. Browser updates alone may not address device-level vulnerabilities.
• Check your accounts: Review email, banking, cloud storage, and work accounts for unfamiliar sign-ins.
• Enable multifactor authentication: Use phishing-resistant authentication when available, though stolen browser sessions can sometimes bypass standard login protections.
• Replace unsupported phones: Devices that no longer receive security updates may remain exposed to known vulnerabilities.

Because the documented payloads did not establish persistence, restarting an affected phone could stop the active malicious processes. However, rebooting would not recover stolen information, patch the vulnerabilities, or prevent another attack if the device revisited a compromised website.

Anyone who suspects their phone was compromised should consider changing important passwords from a trusted device and signing out of active sessions.

Changing passwords alone may not invalidate stolen authentication cookies, so reviewing account sessions is especially important.

Why businesses should pay attention

The threat extends beyond personal photos, messages, and passwords.

Many employees use smartphones to access Microsoft 365, Google Workspace, corporate email, and other business applications. If attackers steal authenticated browser sessions or credentials, they could potentially gain access to sensitive company information.

This creates particular challenges for organizations with bring-your-own-device (BYOD) policies, where IT teams may have limited visibility into employees’ personal phones.

TechRepublic has previously examined how Android vulnerabilities threaten enterprise environments and why organizations need stronger mobile security controls.

For IT administrators, the Poisoned Source campaign highlights four priorities:

1. Find outdated devices: Identify phones running unsupported operating systems, outdated browsers, or missing security patches. Prioritize devices used to access sensitive corporate systems.
2. Monitor suspicious account activity: Investigate unfamiliar sign-ins, unusual geographic locations, and unexpected access to cloud applications. Review potentially compromised authentication sessions.
3. Review third-party website scripts: Audit analytics tools and externally hosted JavaScript, particularly where Plerdy was used during the reported August 27 to September 3, 2026, compromise period.
4. Investigate possible exposure: Review Sekoia’s published indicators of compromise and determine whether employees may have accessed affected websites.

Organizations should also consider enforcing minimum security requirements before allowing devices to connect to corporate resources.

Google has been developing more detailed methods to check Android security patch status, which could help administrators identify vulnerable components on devices more precisely.

What this means for iPhone and Android users

The Poisoned Source campaign demonstrates how dangerous outdated software can become, even when the underlying vulnerabilities were patched months or years earlier.

It also exposes a less obvious risk: Attackers can compromise legitimate websites and trusted third-party services, turning routine browsing into an opportunity to steal sensitive information.

For individual users, keeping phones and browsers up to date is the strongest immediate defense against these documented exploits.

For businesses, the warning is broader. A vulnerable employee smartphone can become another potential route into corporate accounts, making mobile security, patch management, and session monitoring essential parts of protecting company data.

Also read: For more on how personal smartphones can expose corporate data, read TechRepublic’s report on BYOD security risks and the challenges businesses face when employees use their own devices for work.