Why did hackers exploit iOS and Android flaws to infect phones, and how do you check if yours is patched?

Security researchers say a spying campaign used flaws Apple and Google had already fixed — the victims were phones that had not installed the fixes yet. The infection cleared on a reboot, but updating is the real cure. Here is the five-minute patch check for iPhone and Android.

A security story making the rounds this week sounds scary: hackers quietly infecting phones through flaws in iOS and Android. Short answer: researchers at the firm Sekoia found a spying campaign — attributed with moderate-to-high confidence to a Russia-linked group — that booby-trapped lookalike websites so that simply visiting one could profile your phone and, if it ran an old, vulnerable version, try to steal things like cookies, saved Wi-Fi passwords and messages. The key detail: every flaw used had already been patched.

The targets were phones that had not installed the fixes.Why it matters: This is the patch gap in action. When Apple or Google ships a security fix, attackers can compare the old and new code to learn exactly where the hole was, then go hunting for phones still running the old version. No app install was needed here — on the wrong version, a bad web page was enough.

The one piece of good news: this infection did not survive a restart. The bad news: it could return if the phone visited the page again, and only updating closes the door for good.Check your phone now, step by step:1. See what you are running.

On iPhone: Settings, General, About. On Android: Settings, About phone. The campaign hit iOS versions such as 16.7 and 18.5 and Chrome on Android versions 139 to 145 — but the rule is simple: if you are not on the latest version, you are behind.2.

Install the security update. iPhone: Settings, General, Software Update. Android: Settings, Security and privacy, System and updates (the wording varies by brand).3. Update your browser and apps too — on Android, Chrome itself was part of the attack chain, so update it in the Play Store.4.

Restart the phone when the update finishes. That also clears non-persistent infections like this one.5. Turn on automatic updates for the system and your apps, so the next patch gap is measured in hours, not months.6.

Remove anything you do not recognize — on iPhone, check Settings, General, VPN and Device Management for unknown profiles; on Android, uninstall apps you never installed.Common mistake: "My phone works fine, so I will update later." Attackers count on exactly that delay — later is their whole business model.Ad’s take: Five minutes today beats wondering tomorrow. Update, restart, done.