# Zero-Click Attacks Target iOS and Android Devices Using N-Day Exploits

*Published November 6, 2026*
*Source: [https://www.news4hackers.com/zero-click-attacks-exploit-n-day-vulnerabilities-in-ios-and-android-devices/](https://www.news4hackers.com/zero-click-attacks-exploit-n-day-vulnerabilities-in-ios-and-android-devices/)*

## Executive Summary

A large-scale cyber operation linked to Russian threat actors is exploiting zero-click attacks using n-day exploits to compromise iOS and Android devices. The campaign targets high-profile websites, emphasizing the critical need for timely software updates to mitigate these sophisticated threats.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/zero-click-attacks-target-ios-and-android-devices-using-n-day-exploits) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A recently uncovered large-scale cyber operation linked to Russian threat actors has been exploiting zero-click attacks to compromise iOS and Android devices. These attacks leverage n-day vulnerabilities through targeted watering-hole campaigns, allowing hackers to extract sensitive data without any user interaction. High-profile websites across the U.S., Ukraine, the Czech Republic, and Bulgaria were targeted, with the attackers using sophisticated exploit chains tailored to the browser versions detected during their reconnaissance.

The operation utilized compromised websites and fake domains, including those mimicking official sites like America250 and Raffles London at The OWO hotel. An adversary-in-the-middle technique was employed to relay content from legitimate sources. A Ukrainian web analytics service named Plerdy was compromised, and its SEO tracker was modified to inject malicious code, affecting thousands of websites mainly in Ukraine during late August and early September.

iOS devices were targeted with several exploits, including CVE-2025-43529 and CVE-2024-27834, which extracted Safari cookies. Additional vulnerabilities were exploited to access Telegram databases, Keychain credentials, location data, and photos. For Android devices, the attackers used CVE-2026-3910 and CVE-2025-27038 to deploy AndroSnitch, a tool that harvested Chrome cookies, login details, browsing history, and WiFi credentials.

Research identified other vulnerabilities in unused code paths, but these were not part of the active exploit chains. Notably, CVE-2025-43529, associated with the DarkSword exploit kit, has been in use since November 2025 by various threat groups. APT29's payloads did not establish persistence, meaning that device reboots temporarily halted malicious activity until the user revisited a compromised site.

The report underscores the importance of timely software updates, as Apple and Google have addressed the vulnerabilities exploited in these attacks. The incident highlights the ongoing risks of n-day exploits in zero-click scenarios and reinforces the need for vigilance against such sophisticated cyber threats.