On November 4, 2026, security reporting described attacks on Safari on iPhones and Chrome on Android phones. Attackers used compromised or impersonated websites, and researchers spotted the activity in mid-October. Apple lists parallel supported iPhone software releases dated October 26. The reporting doesn’t specify the software-update status of every compromised device, so it offers no reason to buy a new phone.
What happened in the iOS and Android attacks
Sekoia identified the campaign and assessed with moderate-to-high confidence that it was linked to APT29. According to reports of the researchers’ findings, attackers placed JavaScript on compromised or impersonated websites. The code checked each visitor’s device and chose an attack for vulnerable software. This is a watering hole attack: it reaches people through a site they visit. In the reported cases, an affected page could start the attack as it loaded.
Zero-click means visitors didn’t have to tap a malicious link after reaching the page or approve a download. The attack still required an affected page and software vulnerable to the chosen chain. Visiting any website wouldn’t infect every phone.
Researchers linked the campaign to APT29, also tracked as Midnight Blizzard, a group reportedly associated with Russian intelligence, according to security reporting. The reporting doesn’t indicate whether Apple or Google has commented on that attribution.
How it stacks up
The useful comparison is between the software reportedly targeted and the updates offered for your device. The evidence doesn’t show whether Apple patched this campaign faster or slower than Google or Samsung.
| Platform | Reported target | What the evidence says |
|---|---|---|
| iPhone | iOS 16.7 and iOS 18.5 | Researchers described a separate attack chain for each version. Apple lists iOS 27.2, iOS 26.7.2, and iOS 18.7.11 security releases dated October 26, 2026, for different supported devices. Campaign reporting · Apple releases |
| Android devices | Certain Chrome versions from 139 through 145, excluding 143 | A separate reported chain sought browser and saved Wi-Fi data. The research has no Pixel- or Galaxy-specific results or comparable patch-date table. Sekoia analysis |
| Mac and Windows | No target established in the supplied campaign reporting | The report covers mobile iOS and Android chains. It gives no basis for ranking macOS or Windows against them. Campaign reporting |
iOS: Which iPhones were reported as targets?
The reported iPhone chains targeted iOS 16.7 and iOS 18.5. Depending on the chain, attackers sought Safari cookies or other private data. Sekoia’s analysis describes the iOS 18.5 chain as collecting messaging databases, credentials, location data, and photos. These were reported targets and collection goals. They don’t show that every iPhone running either version was infected. Source: security reporting
Apple’s security-release index lists iOS 27.2, iOS 26.7.2, and iOS 18.7.11 on October 26, 2026. Each release supports different devices, so your iPhone may not offer the highest number. Apple’s iOS 27.2 security bulletin confirms the release date. The available evidence doesn’t show that iOS 27.2 fixed every flaw in the reported chains.
Android: How does the evidence compare?
Sekoia reports that the Android chain targeted certain Chrome versions from 139 through 145, excluding 143. It sought browser and saved Wi-Fi data. The research doesn’t say all Android phones were vulnerable. It also doesn’t show whether a particular Google Pixel or Samsung Galaxy model was compromised.
macOS: Was the Mac part of this campaign?
The reporting describes attacks on iPhones and Android phones. It doesn’t establish a macOS attack chain or show that this campaign affected Mac users. Source: campaign reporting
Web: Why did the website matter?
The website delivered the attack. The reported JavaScript checked the visitor’s device and chose a matching chain when it found vulnerable software. That’s why your browser and phone software versions matter here. A visitor didn’t have to knowingly download an app. Source: security reporting
Our take
Verdict: update your phone; the evidence doesn’t make a case for replacing it. Sekoia’s November 4 analysis says all three chains used known vulnerabilities patched before the campaign began, rather than new zero-days. The reporting doesn’t specify the update status of every compromised device.
The reporting also doesn’t show whether Apple handled this threat better, later, or worse than Google or Samsung. Sources: campaign reporting · Apple security releases
On an iPhone, open Settings > General > Software Update. Install the latest security update offered for your model. On Android, check the software and Chrome updates available for your phone. Check your update status before deciding whether to replace the device.
Wrapping Up
An affected page could reportedly start an attack without another tap. The chains still needed specific vulnerable software. Check which updates your phone offers; that’s the practical step the evidence supports.