[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbPLJKh1-R1OW7jhj_s0q7vZDQaXPKdti0tEd7v-ZB9Q":3},{"article":4,"iocs":54,"watch_terms":76,"solutions":77,"lesson":176},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1e820c99-fac0-477c-a244-82c0dddbda69","Hackers use n-day exploits in zero-click attacks on iOS, Android devices","hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices-e3fd45","A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...]","A sophisticated watering hole attack, attributed to Russian APT29 (Midnight Blizzard), has targeted iOS and Android users by exploiting n-day vulnerabilities. The campaign leveraged compromised websites and lookalike domains to deliver platform-specific exploit chains without user interaction, aiming to profile visitors and steal sensitive data like cookies, credentials, and messaging app databases. While the attackers did not establish persistence, Apple and Google have since patched the exploited flaws.","APT29 hackers exploit n-day vulnerabilities in zero-click attacks on iOS and Android.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F13\u002FRussian_hacker.jpg","2026-11-04T09:39:54+00:00","2026-11-04T10:00:25.137364+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"APT29","threat_actor",{"name":21,"type":19},"Midnight Blizzard",{"name":23,"type":24},"iOS","product",{"name":26,"type":24},"Android",{"name":28,"type":24},"Chrome",{"name":30,"type":24},"Safari","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,67,69,71,74],{"type":56,"value":57,"context":58},"cve","CVE-2025-43529","Exploited in iOS 16.7 and iOS 18.5 for cookie theft and data harvesting.",{"type":56,"value":60,"context":61},"CVE-2024-27834","Exploited in iOS 16.7 for cookie theft.",{"type":56,"value":63,"context":64},"CVE-2026-20700","Exploited in iOS 18.5 for harvesting WhatsApp\u002FTelegram data, credentials, and location.",{"type":56,"value":66,"context":64},"CVE-2025-14174",{"type":56,"value":68,"context":64},"CVE-2025-43510",{"type":56,"value":70,"context":64},"CVE-2025-43520",{"type":56,"value":72,"context":73},"CVE-2026-3910","Exploited in Chrome for Android (139-145, excl. 143) for collecting cookies, login data, and WiFi credentials.",{"type":56,"value":75,"context":73},"CVE-2025-27038",[23,26,28],{"controls":78,"vendors":164},[79,108,137],{"slug":80,"name":81,"problem":82,"products":83},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":138,"name":139,"problem":140,"products":141},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[142,150,158],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":159,"product_name":160,"url":162,"description":163},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",[165,171],{"slug":166,"name":167,"logo_path":168,"roles":169},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[170],"affected",{"slug":172,"name":173,"logo_path":174,"roles":175},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[170],{"slug":177,"title":178,"body":179,"framework_refs":180,"framework_notes":188},"apt29-zero-click-attacks-exploit-unpatched-ios-and-android-flaws","APT29 Zero-Click Attacks Exploit Unpatched iOS and Android Flaws","Russian APT29 exploited known n-day vulnerabilities — flaws with existing patches — to silently compromise iOS and Android devices through watering hole attacks on legitimate and lookalike websites, requiring no user interaction whatsoever. The core failure was the gap between patch availability and patch deployment: both Apple and Google had issued fixes, but many users and organizations had not applied them, leaving devices exposed. Attackers were able to harvest cookies, credentials, and messaging app databases, demonstrating that even without establishing persistence, transient access can yield highly sensitive intelligence. This incident underscores that n-day vulnerabilities are operationally equivalent to zero-days when patching cadences are slow. Organizations must treat mobile device patch management with the same urgency applied to server and endpoint patching.",[181,182,183,184,185,186,187],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":189,"MITRE ATT&CK T1566: Phishing":190,"NIST SP 800-53 SI-2: Flaw Remediation":191,"OWASP A06:2021 Vulnerable and Outdated Components":192,"CIS Control 7: Continuous Vulnerability Management":193,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":194,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":195},"NIS2 requires entities to implement vulnerability handling and patching policies; the delayed application of available patches on mobile devices represents a direct gap in this obligation that enabled the APT29 campaign.","While zero-click, the watering hole and lookalike domain delivery mechanism mirrors adversarial web-based luring techniques categorized under phishing, highlighting the need for domain monitoring and user traffic controls.","SI-2 requires organizations to identify, report, and correct information system flaws; applying vendor-issued patches promptly would have directly prevented these n-day exploits from succeeding.","The attack succeeded because device operating system components were outdated; this OWASP risk category directly addresses the danger of running software with known, patchable vulnerabilities.","APT29 exploited patched n-day vulnerabilities, meaning continuous scanning and enforced patch deadlines on mobile devices would have closed the window of exposure before exploitation.","This control mandates timely identification and remediation of technical vulnerabilities, which if followed for mobile platforms, would have ensured patches were applied before APT29 leveraged them.","Stolen cookies and credentials harvested in these attacks could enable further unauthorized access, making strong session management and re-authentication controls essential mitigating factors."]