Russian‑backed watering‑hole operation leverages zero‑click mobile exploits

A team of security analysts has uncovered a widespread watering‑hole campaign that uses unpatched (n‑day) flaws to launch zero‑click attacks on iOS and Android phones. The operation, which seems to be directed by a Russian state‑aligned espionage group, aims at users who merely visit compromised sites or fake portals that imitate genuine services.

Following the typical watering‑hole model, the threat actors either hijack authentic web properties or create replica sites designed to lure particular targets. By embedding malicious code into these pages, they establish a covert delivery vector that triggers as soon as a device renders the page, requiring no interaction other than the visit itself.

At the heart of the scheme are n‑day exploits—publicly known weaknesses that many devices have yet to patch. Analysts spotted exploit chains that abuse defects in mobile browsers and WebView modules, enabling remote code execution without any click. For iOS devices, the chain compromises the WebKit engine; for Android, it exploits bugs in Chrome or the native WebView, gaining access without the user’s permission.

Since the exploit activates merely by loading the page, any user who accesses the compromised site may be silently compromised. After the payload is placed, it can open a back‑door, siphon data, or pull down further spying utilities. The threat spans personal smartphones as well as corporate‑issued devices, particularly where users postpone OS updates.

Vendors received notice after the findings were first reported by BleepingComputer. Apple and Google are anticipated to speed up patch roll‑outs, while security companies are publishing guidance that advises users to install the newest OS updates, use trusted browsers, and double‑check URLs before providing credentials. Recommendations also include deploying enterprise mobile‑device‑management tools to ensure prompt patching.

Experts caution that the actors behind the operation will probably polish their arsenal and seek additional victims as mobile platforms grow more valuable for intelligence collection. Continuous monitoring and cooperation among industry, academia and law‑enforcement will be essential to curb the danger and stop comparable zero‑click exploits from spreading further.