How did a Russia-linked hacking campaign attack phones just for visiting ordinary websites — and how do you protect yours?

Sekoia reports APT29, tied to Russia’s SVR, hid attack code inside legitimate websites so unpatched phones were attacked the moment a page loaded — using bugs that already had public fixes. Why this was an attack on update habits, and the five steps that close the door.

You did nothing reckless: no strange link, no dodgy download — you just opened an ordinary website on your phone. Short answer: security firm Sekoia reported on November 4 that APT29, the group tied to Russia’s SVR foreign intelligence service, injected attack code into legitimate websites — a ‘watering hole’ — so that visitors’ phones were attacked automatically when the page loaded. No tap, no download, no warning.Why it matters: The campaign’s three attack chains targeted older iOS versions and Chrome versions 139 to 145 on Android, aiming at messages, passwords, photos and location.

Every flaw it used was an ‘n-day’ bug: a vulnerability that already had a public fix available. That is the lesson most coverage skips — this was not an attack on brand-new phones or careless users. It was an attack on update habits.

The spies did not need a brand-new weapon; they just needed your phone to be a few updates behind.How to protect your phone, step by step:1. Install system updates promptly. On iPhone: Settings, General, Software Update.

On Android: Settings, then System or Software update. ‘Promptly’ means days, not months.2. Update Chrome separately on Android. Open Chrome, tap the three dots, then Settings, then About Chrome to see its version — and update the app in the Play Store.

The attack arrives through the browser, so the browser has to be current.3. Turn on automatic updates for both the system and your apps, so the fix lands even when life gets busy.4. Restart your phone weekly.

Sekoia notes these payloads did not dig in permanently, so a reboot clears this kind of attack until a booby-trapped page is visited again.5. Be hardest to hit on the phone you browse with. If an old spare phone no longer receives updates, retire it from everyday browsing and banking.Pro tip: Check a family member’s phone too — the person most at risk is usually the one whose ‘Remind me later’ is six months old.Ad’s take: You cannot outsmart a booby-trapped web page by being careful.

You beat it by being current — updates are the lock, and this story is what the lock is for.