iPhone hacked by opening a website: how Russia-linked APT29 hit iPhones and Android phones

An iPhone could be hacked just by opening the wrong web page, with no tap and no download. That is what French security firm Sekoia reported on 4 November, describing a campaign against iOS and Android that it links to Russia's APT29 with "moderate to high confidence". The diff: exploit kits once reserved for spyware customers are now being reused against anyone who skipped an update. The good news is in the same report: every flaw was already patched, and Sekoia says "a user running an up-to-date operating system is safe from these attacks."

Our short version:

How were iPhones hacked by a website?

This is a watering hole attack. Instead of sending a phishing link, the attackers poison pages their targets already visit. Sekoia found three ways in:

• Hacked real sites. Malicious JavaScript appeared on the site of a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related organisation.
• Lookalike domains. Two sites passed through the real pages of America250, the US 250th anniversary project, and of Raffles London at The OWO, adding the attack code on the way. Sekoia describes these as reverse proxies, not hacks of the real sites.
• A poisoned tracker. From 27 August to 3 September 2026, the attackers added their code to the tracking script of Plerdy, a Ukrainian web analytics service. Sekoia says that script loads on thousands of sites, most of them Ukrainian, including army, special forces and military equipment sites.

The Old War Office building, now the Raffles London at The OWO hotel. Sekoia says the fake copy of the hotel's site may have been aimed at diplomats and senior guests. Image: Txllxt TxllxT (CC BY-SA 4.0, Wikimedia Commons)

All three routes load the same script, which the attackers named UltimateFingerprinter. It reads the phone's OS and browser version, and the server then picks the matching exploit. Sekoia says the chains run "without user interaction".

NextDiff graphic. Source: Sekoia TDR

What did the hackers steal?

It depends on the phone:

Target	What was taken
iOS 16.7	Browser cookies, which can let an attacker reuse logged-in sessions such as webmail
iOS 18.5 (DarkSword kit)	SMS and iMessage, WhatsApp and Telegram databases, Keychain, contacts, call history, photos, location and health data
Android, Chrome 139 to 145, except 143	Chrome cookies, saved logins, browsing history and Wi-Fi passwords

The payloads do not stay on the phone after sending the data. That makes the attack harder to detect afterwards, but stolen cookies and passwords can keep working long after the code is gone. One odd detail: The Hacker News reports the Android chain stops if it sees a Samsung Galaxy S25 Ultra. Sekoia does not say why.

iPhone hacked: how to check if you are at risk

There is no simple public test for this campaign, and Sekoia has not published a victim count. It is working with national CERTs, including Ukraine's CERT-UA, to identify victims. So check what you can control:

1. iPhone: open Settings, General, About and read your iOS version. Then go to Settings, General, Software Update and install what is offered.
2. Android: update the system, then update Chrome from the Play Store. In Chrome, Settings, About Chrome shows your version.
3. If you were on an old version: our advice, not Sekoia's, is to sign out of important accounts on all devices and change key passwords, because stolen sessions outlive the malware.

Most people are unlikely targets, since the victims Sekoia describes centre on Ukraine and the US. But the Plerdy route was a wide net, and Sekoia says it is unclear whether the attackers wanted specific visitors or as many unpatched phones as possible.

Old iPhones deserve extra care. Apple's fix for CVE-2025-43529, the WebKit bug used in both iOS chains, is listed for iOS 18.7.3 and 26.2. We could not confirm a fix for iOS 16 in the records we read, so treat a phone stuck on that version as higher risk.

Why it matters: patched bugs are still dangerous

Every bug here is an "n-day", a flaw that is public and fixed. The patches came months earlier: Google's timeline shows Apple fixing DarkSword's bugs between July 2025 and February 2026.

Image: Google Threat Intelligence Group

Sekoia's warning is about cost. It says packaged exploit kits, first built by commercial surveillance vendors, lower the bar for advanced mobile attacks, and that reuse will likely grow. The Hacker News also reports a DarkSword variant delivered through a malicious Instagram ad and a criminal campaign that buys expired analytics domains.

For teams that ship websites, the Plerdy case is the lesson. A third-party script runs with full access to your page, so one vendor compromise can turn your site into a trap. We covered the same pressure on patching in the Linux TCP flaw story.

Plerdy's homepage. Sekoia says its tracking script was poisoned for one week. Image: Plerdy (screenshot)

What's next, and the caveats

CISA added CVE-2024-27834, the Apple flaw used in the iOS 16.7 chain, to its Known Exploited Vulnerabilities catalog on 4 November. US federal civilian agencies must patch by 18 November. Help Net Security notes that CISA did not name an attacker or tie the listing to Sekoia's report.

The APT29 link is an assessment, not proof. Sekoia bases it on traces of a 2025 APT29 operation on one compromised site, overlap with a 2024 campaign that Google tied to the group, and a victim list centred on Ukraine. Some compromised sites, such as an Australian medical clinic, have no obvious strategic value, and the full list of affected sites is not public.