Hackers use n-day exploits in zero-click attacks on iOS, Android devices

A large-scale watering hole campaign attributed to Russian threat actors has been targeting iOS and Android users. Attackers compromise legitimate websites or create fake portals impersonating real ones to deliver exploits. The campaign leverages n-day exploits in zero-click attack chains, meaning victims do not need to interact beyond visiting the malicious or compromised site. Both iOS and Android platforms are affected, suggesting a broad and sophisticated operation. The use of n-day (known but recently patched) vulnerabilities indicates attackers exploit the gap between patch release and user adoption. This type of attack is particularly dangerous as it requires no user interaction to compromise devices. The campaign highlights the ongoing threat posed by state-sponsored Russian hacking groups targeting mobile platforms.