Opening a Legitimate Site Can Expose Smartphone Data: Large-Scale Attacks Chain Already-Patched Flaws

Security company Sekoia identified a large-scale watering-hole campaign targeting unpatched iPhones and Android devices by planting malicious code on trusted websites, allowing data theft when users simply open a page. Apple and Google have already patched every vulnerability used, and fully updated devices are unaffected.

Key points

• What happened: Sekoia identified large-scale attacks stealing information from unpatched iPhones and Android devices without additional clicks through compromised legitimate sites and an analytics service
• Why it matters: Apple and Google have patched every vulnerability used; only devices without those updates are vulnerable, while fully updated devices are unaffected
• The emerging pattern: DarkSword, an intrusion toolkit from a commercial surveillance vendor, is being reused by state-linked groups; packaging patched vulnerabilities lowers the barrier to sophisticated mobile attacks

Trusted websites became entry points

According to research published by Sekoia's Threat Detection and Research (TDR) team in mid-October 2026, the attacks spread through three routes.

The first was JavaScript injected into real, legitimate websites. Malicious loading code was added to page templates or existing JavaScript files on sites including a Ukrainian natural gas company, a US chemical industry association, and a Bulgarian military-related site.

The second used impersonation domains that relayed legitimate site content while injecting malicious code. Researchers identified america250.holiday, imitating the official US semiquincentennial site, and theowo.club, posing as luxury hotel Raffles London at The OWO. Given the hotel's proximity to the UK Ministry of Defence and the prime minister's office, Sekoia suggests the impersonation may have targeted diplomats and prominent individuals.

The third was a supply chain attack on Ukrainian web analytics service Plerdy. For roughly one week from August 27 to September 3, malicious loading code was inserted into its tracker. Although thousands of sites embedded Plerdy's tracker, Sekoia identified actual exposure to attack code only for hundreds of legitimate sites and their visitors. These reportedly included sites associated with Ukraine's military, special forces, and military equipment.

All three routes initially loaded JavaScript called UltimateFingerprinter. This roughly 2.3MB script uses 61 routines to collect 394 device attributes, including OS, browser, screen size, and input devices. However, Sekoia found that these detailed attributes had little effect on attack delivery. Only basic checks of screen size and touch-point count determined whether exploit code was delivered.

Different exploit chains for different devices

After receiving device information, the server delivered one of three exploit chains according to OS and browser version. None required additional user action; opening the page was enough.

Two chains targeted iOS. The iOS 16.7 chain combined WebKit vulnerability CVE-2025-43529 with CVE-2024-27834, which bypasses Pointer Authentication Codes, Apple's defense using cryptographic signatures to protect pointers during code execution. It stole cookies stored by browsers and apps.

The iOS 18.5 chain was more serious, chaining five vulnerabilities to enter through WebKit, escape the sandbox that isolates apps, and gain kernel-level privileges. This chain was DarkSword itself (in Japanese), an iOS exploit kit suspected to have been developed by a commercial surveillance vendor. It collected a wide range of data: SMS, iMessage, WhatsApp and Telegram databases, Keychain credentials, contacts, call history, location data, photos, and iCloud Drive.

The Android chain targeted Chrome 139–145, excluding 143. It used V8 JavaScript engine vulnerability CVE-2026-3910 for code execution, then Adreno GPU driver vulnerability CVE-2025-27038 to escape the browser sandbox. The final stage, named AndroSnitch by Sekoia after a similar collector called AndroSnatch reported by Google TAG in 2024, collected and exfiltrated Chrome cookies, login data, browsing history, and saved Wi-Fi credentials. The exploit code also stopped attacks upon detecting a Samsung Galaxy S25 Ultra, for reasons that remain unknown.

Figure omitted — see the original article

All three chains sent collected data to the same server.

Every flaw is patched, but unupdated devices remain exposed

The central point is that all the vulnerabilities used were known and already patched.

According to Sekoia, none of the three chains contains a zero-day, an unknown vulnerability, and none succeeds against fully updated devices. Attackers did not find new holes. They exploited old ones still open on devices.

For WebKit vulnerability CVE-2025-43529, the chains' entry point, Apple states in its security content that it may have been exploited in extremely sophisticated attacks against specific targeted individuals. Google likewise said in its patch release that it was aware of an exploit in the wild for V8 vulnerability CVE-2026-3910.

Another important feature is that the analyzed final payloads have no persistence mechanism. Restarting the device stops the running malicious activity. But a reboot only stops further theft; it does not recover cookies, passwords, or messages already sent out. If compromise is suspected, updates must be applied, followed by password changes for important accounts and invalidation of sessions.

The published research does not identify compromised sites or affected devices in Japan. However, Japan's Ministry of Internal Affairs and Communications 2026 Information and Communications White Paper puts individual internet use through smartphones at 74.3% in 2025. With iPhones and Android devices used for everyday communication, the same technical conditions apply if an unpatched device encounters a page containing exploit code.

The defense comes down to checking updates. On iPhone, check iOS under "Settings" → "General" → "Software Update." On Android, check Chrome under "Chrome" → "Settings" → "About Chrome." If the manufacturer no longer provides security updates for a device, considering replacement is a practical option.

Reused commercial intrusion tools and uncertain attribution

DarkSword is central to the iOS exploit chains used here. Believed to have been developed by a commercial surveillance vendor—companies such as NSO Group that sell intrusion tools to governments—the iOS exploit kit became public after an upload to VirusTotal in September 2026. Sekoia found that its remote code execution (RCE) component was reimplemented in the iOS 16.7 chain, while the iOS 18.5 chain used DarkSword directly.

Google TAG reported in 2024 that state-sponsored groups were reusing commercial surveillance vendors' exploit frameworks. This case continues that pattern. Sekoia concludes that adopting packaged exploit chains built from patched vulnerabilities reduces the cost and technical threshold for sophisticated mobile attacks.

Sekoia attributes the operation with medium to high confidence to APT29, also known as Midnight Blizzard and attributed to Russia's Foreign Intelligence Service (SVR), based on technical overlaps, infrastructure characteristics, victim distribution, and links to earlier attacks. Evidence includes traces in compromised sites' backend files matching a 2025 APT29 attack, and Google TAG's confirmation that the framework resembles one used against Mongolian government sites in 2024. This is the researchers' attribution assessment, not direct confirmation of the attackers' identities.

Regardless of who is responsible, the structural lesson remains. Trust in legitimate sites and third-party scripts embedded across thousands of websites became routes to devices retaining patched vulnerabilities. Those supplying fixes have already done their work. What remains is owners' action to get those fixes onto their devices.

Originally published on Joho no Todai. The Japanese original is here.