Hackers Exploit Old iPhone and Android Flaws
A watering-hole campaign used compromised and fake sites against devices running patched-but-outdated software, per Sekoia's research.
Updated on Nov. 4, 2026 in Cybersecurity
Live Poll
Do you trust that websites you visit on your phone are safe?
Hackers targeted iPhone and Android users by compromising legitimate websites, building fake domains that impersonated well-known organisations, and hijacking a web analytics service. Researchers at Sekoia uncovered the watering-hole campaign in mid-October 2026 and published their findings on November 4, 2026. The development is a documented, already-observed campaign rather than a product or announcement.
Why it matters
The campaign shows attackers tailoring malware to specific browser and OS versions after fingerprinting each visitor's device, a targeting approach that reaches people who simply visit trusted-looking sites. It relied on previously disclosed flaws that Apple and Google had already patched, underscoring how long unpatched devices remain exposed.
The campaign combined roughly 5,400 compromised websites with attacks against iOS 16.7 and iOS 18.5, using the old flaws to pull Safari cookies and messaging databases. Sekoia did not establish how many devices were successfully compromised, and the malware did not gain permanent access to infected devices.
The players
Sekoia
A cybersecurity firm that uncovered and published research on this watering-hole campaign.
Apple
The maker of iOS, whose previously patched flaws in older iPhone versions were exploited in the campaign.
The maker of Android and the Chrome browser, whose previously patched flaws in older Android versions were exploited in the campaign.
The details
The attackers used a watering-hole attack, planting malicious code on websites that intended targets were likely to visit rather than contacting victims directly. Embedded code first identified each visitor's device and browser version, then delivered an exploit matched to those details. Attackers reached visitors through compromised legitimate sites, fake domains impersonating known organisations such as copies of the America250 initiative and Raffles London at The OWO hotel, and a hijacked web analytics service.
Timeline
Attackers modified the Plerdy web analytics tracking code between August 27 and September 3, 2026.
Sekoia uncovered the campaign in mid-October 2026.
Sekoia published its findings on November 4, 2026.
The Tech Race
The campaign follows the watering-hole pattern Sekoia documented, extending it with fake domains and a hijacked analytics service as delivery routes. It shows attackers relying on vulnerabilities Apple and Google had already patched, so the race against unpatched devices remains a central factor.
Anyone who visits a compromised or lookalike website on an older iPhone or Android device could be exposed, so keeping devices on current iOS and Chrome versions closes the flaws this campaign used. Users on the affected older versions should update their operating systems and browsers as soon as patches are available.
The takeaway
Keeping iOS and Chrome on current versions removes the patched flaws this campaign exploited. Watch for whether Sekoia or other researchers publish a count of successfully compromised devices, which the initial findings did not establish.
Further reading
For more on how attackers exploit trusted websites and unpatched devices, see our Cybersecurity coverage.
Source note: This article includes information reported by GULF NEWS.
Live Poll
Do you trust that websites you visit on your phone are safe?
