Russian-linked watering‑hole campaign deploys zero‑click mobile exploits

Security researchers have identified a large‑scale watering‑hole operation that is exploiting unpatched (n‑day) vulnerabilities to deliver zero‑click attacks against smartphones running iOS and Android. The campaign, which appears to be orchestrated by a Russian cyber‑espionage group, targets users who simply browse to compromised websites or to counterfeit portals that mimic legitimate services.

In a classic watering‑hole scenario, the attackers compromise legitimate web properties or set up look‑alike sites that attract specific victims. By injecting malicious code into the pages, they create a silent delivery mechanism that activates when a device loads the page, eliminating the need for any user interaction beyond visiting the site.

The technical core of the operation relies on n‑day exploits—vulnerabilities that have been publicly disclosed but remain unpatched on many devices. Researchers observed exploit chains that take advantage of flaws in mobile browsers and WebView components, allowing remote code execution without a click. On iOS, the chain targets the WebKit engine; on Android, it leverages vulnerabilities in Chrome or the system WebView, achieving a foothold without user consent.

Because the attack requires only page loading, any visitor to the tainted site can be silently infected. Once the payload is installed, it can establish a back‑door, exfiltrate data, or download additional surveillance tools. Both consumer devices and those used in corporate environments are at risk, especially where users delay operating‑system updates.

Vendors have been alerted following the disclosure originally reported by BleepingComputer. Apple and Google are expected to accelerate patch releases, and security firms are issuing advisories urging users to apply the latest OS updates, employ reputable browsers, and verify URLs before entering credentials. Enterprise mobile‑device‑management solutions are also being recommended to enforce timely patching.

Analysts warn that the group behind the campaign is likely to refine its toolkit and pursue new targets as mobile platforms become increasingly valuable for intelligence gathering. Ongoing monitoring and collaboration between industry, academia, and law‑enforcement will be crucial to mitigate the threat and prevent similar zero‑click exploits from reaching a broader audience.