Update iPhones and Android Phones After Zero-Click Attacks

Hackers used compromised and imitation websites to target iPhones and Android devices without requiring visitors to click a link or install an app. Apple and Google have patched the exploited flaws, so installing the latest available security update is the most important step households can take.

What happened

According to BleepingComputer, the large campaign placed malicious code on legitimate websites and on fake sites designed to resemble real organizations. The affected sites included a U.S. chemical industry trade association, organizations in Ukraine and Bulgaria, and imitation pages for the America250 site and a London hotel.

When someone visited one of these pages, JavaScript checked the device and browser version. The attackers could then send an exploit chain suited to that phone without further action from the visitor. Researchers at Sekoia linked the operation to the Russian group known as APT29 or Midnight Blizzard with moderate-to-high confidence, BleepingComputer reported.

The attacks were designed to obtain browser cookies, credentials and messaging-app databases. The malicious payloads did not remain active permanently on the device, according to the report. Restarting the phone stopped the activity, but visiting an affected site again could restart it while the device remained unpatched.

Google and Apple have fixed all of the flaws identified in the campaign. BleepingComputer reported that Apple also delivered fixes for older iOS releases. The source did not disclose a complete list of affected phone models or the minimum safe operating-system versions.

Who is affected

Anyone using an iPhone or Android device that has not received the latest available security updates could face greater risk when visiting a compromised or convincing imitation website. Because legitimate sites were also altered, the danger was not limited to people who knowingly visited suspicious pages.

The report does not say that every iPhone or Android phone was successfully attacked. The malicious system first identified a visitor’s device and browser version before deciding which exploit chain to send.

What to do now

1. Install the newest security update offered by your phone. Open the device’s Settings app, find its software or system update screen, and check manually rather than waiting for a reminder. Install every available operating-system security update.

2. Check older iPhones too. Apple issued fixes for older iOS releases, according to BleepingComputer. An older phone may therefore have an update even if it cannot run the newest major iOS version.

3. Restart the device after updating. The researchers found that a reboot stopped the observed malicious activity because the payloads did not establish persistence. Restarting alone is temporary protection, however, if the phone remains unpatched and encounters an affected site again.

4. Update every household phone and tablet separately. Do not assume updating one device protects others using the same Wi-Fi network or family account.

5. Inspect web addresses before entering credentials. The campaign used lookalike domains that copied legitimate sites. If a page asks you to sign in, leave it and navigate to the organization through a trusted bookmark or a web address you already know.

6. Replace devices that no longer receive security fixes. The specific affected models have not been disclosed, but a phone that cannot install current security updates cannot receive these protections.