Poisoned websites delivered data-stealing exploits to outdated iPhones and Android phones

Opening an ordinary web page was enough, on an unpatched phone, to start a chain that could take messages, photos, passwords and Wi-Fi credentials. That is the campaign SecurityWeek reported on November 5, 2026, based on research from the French firm Sekoia. Sekoia believes the operator is Midnight Blizzard, also known as APT29 or Cozy Bear, a group widely linked to Russia’s foreign intelligence service. The exploits were not brand-new holes. They were flaws Apple, Google and Qualcomm had already patched. A phone that has kept its updates is outside the set these chains were built for.

Sekoia’s own write-up was not available to us when this was published. The details below are the ones SecurityWeek reported from that research, plus CISA’s public notice on one of the bugs.

What Sekoia describes

SecurityWeek says Sekoia found a watering-hole campaign aimed at iPhone and Android users in Europe and the United States, mainly in Ukraine. The pages did not ask anyone to tap a link inside the attack itself. Script on the site fingerprinted the visitor, collected browser and device details, and sent them off as JSON. The exploit came after that.

The sites were a mix of compromised pages and lookalikes:

• Malicious JavaScript on the sites of a Ukrainian gas producer, a major industry association, and a far-right European political party.
• Modified legitimate files on a Bulgarian military-related website.
• Two lookalike domains that sat in the middle and proxied real sites: a copy of america250.org, the site for the 250th anniversary of American independence, and a copy of the site for Raffles London at The OWO, a hotel near UK government buildings. Sekoia said the hotel copy may have been meant for diplomatic visitors. It pointed to open reporting that Ukraine’s president stayed at that hotel on October 14. That is context Sekoia offered for who might have been the intended visitors. It is not a statement that any particular guest was infected.
• A supply-chain change at Plerdy, a Ukrainian web analytics service. The attackers added their code to the tracker. SecurityWeek says that exposed hundreds of websites for one week, including sites related to the army, special forces, and military equipment.

What the phones were asked to give up

SecurityWeek says Sekoia identified three chains. All three use vulnerabilities that had already been fixed. The two iPhone chains lean on DarkSword, an exploit kit uncovered earlier this year.

The first chain reuses DarkSword’s opening code to get the ability to read and write memory, then uses CVE-2024-27834 to get around Apple’s Pointer Authentication and run code that steals cookies outside Safari. Apple patched that bug in May 2024, in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. On November 4, 2026, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. CISA’s alert tells federal civilian agencies to prioritise catalogued bugs under its current directive, and it encourages everyone else to do the same. It does not, in that alert, name Midnight Blizzard.

The second chain, SecurityWeek says, uses DarkSword for the whole path: initial access, code execution and higher privileges. The payload was built to collect messages, emails, voicemails, credentials, tokens, contacts, calls, calendar entries, browser cookies and history, photos and iCloud Drive content.

The Android chain uses CVE-2026-3910, a Chrome bug patched in March after it was used as a zero-day, and CVE-2025-27038, a Qualcomm bug patched in Android’s August 2025 security update. The payload, which Sekoia calls AndroSnitch, goes after data stored in Chrome: cookies, account information, passwords and browsing history, plus Wi-Fi passwords. SecurityWeek says it resembles AndroSnatch, a Chrome cookie stealer that Google’s Threat Analysis Group has described in Midnight Blizzard activity from 2023 and 2024.

Sekoia’s conclusion, as SecurityWeek quotes it, is that packaged exploit kits from commercial surveillance vendors lower the cost of this kind of mobile attack, and that state-linked groups are likely to keep reusing them.

What you can do

1. Update the phone. On iPhone, install the latest iOS. On Android, install the latest system update and the latest Chrome. These chains were aimed at versions from before the fixes above. A current phone is not what they were written for.
2. If the phone cannot take those updates, do not use it for mail, banking or work chat. An iPhone stuck on iOS 16 or 17.4, or an Android phone that never received the August 2025 patch, is in the range these bugs affected.
3. After a suspected visit, sign out of important accounts and sign back in from a current device. Stolen cookies are the same problem as an infostealer on a computer: the password is not what the attacker needs. Our guide to how infostealers steal sessions walks through clearing sessions.
4. If you run a website, know which third-party scripts you load. The Plerdy case was one analytics file changed for a week. A script you did not review is a script you cannot vouch for.

This campaign was aimed at specific visitors, not at every phone on the internet. The practical lesson for everyone else is the unremarkable one: the fixes already exist, and an old phone does not have them.

How Frame helps

Frame does not patch a phone or block a watering hole. If a stolen session is later used in a way that puts your email into a known breach, Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also give each service its own address, so a message that arrives at the wrong one is easier to question. Frame never collects or stores the leaked records themselves.

Related coverage

• How infostealers steal your sessions, and why a new password isn’t enough: the same end result as the cookie theft described here, and the recovery order that matters.

Sources

• SecurityWeek, Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes, November 5, 2026
• CISA, CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2024-27834), November 4, 2026