Known flaws exploited on older iOS and Android, and a claimed Lockdown Mode bypass

Security firm Sekoia published an investigation on 4 November into a watering-hole attack, in which attackers compromise websites their targets are likely to visit and wait for them to arrive. Code planted on the sites served each visitor an exploit matched to their phone's operating system and browser version. Both iPhones and Android phones were in scope, with the Android side aimed at older versions of Chrome and a Qualcomm chip driver. According to Sekoia's report, every flaw used had already been patched, and phones updated to the latest system are not affected.

In an unrelated development, the research team Calif posted a video on 3 November claiming to have run an exploit on an iPhone 18 Pro with Lockdown Mode turned on (Apple's hardened protection for a small number of high-risk users). The accompanying post, as reproduced by Privacy Guides and MacRumors, read: "Lockdown Mode helps, until it doesn't." As of 8 November Calif had released only the video, with no technical details, and we found no response or fix from Apple.

According to the report, Sekoia found in mid-October 2026 that several high-profile websites in the United States, Ukraine, the Czech Republic and Bulgaria had been compromised or cloned. The attackers used three routes: injecting JavaScript directly into the sites, setting up proxy servers that impersonated the originals, and, between 27 August and 3 September, compromising the tracking code of Plerdy, a Ukrainian web analytics service (a snippet many sites embed to measure visitor behaviour). In the body of the report, this tracking code is described as loaded by thousands of websites, most of them Ukrainian. According to the introduction, the week-long compromise exposed hundreds of legitimate websites, and their visitors, to the exploits.

All three routes end by loading the same script, which profiles the visitor's browser and device, and the server then delivers a matching exploit chain without any action from the user. The report lists three chains, two aimed at iOS 16.7 and iOS 18.5 and one at Chrome for Android versions 139 to 145 (excluding 143). On iPhones the payloads took cookies (data a site stores in the browser to keep you logged in) or full device data, and on Android they took Chrome data and Wi-Fi passwords, without remaining installed on the phone. Sekoia assesses that the data collected fits intelligence-gathering goals, and that the attackers may have used the cookies to reuse logged-in sessions and get into services such as webmail.

The report attributes the campaign to APT29 with moderate to high confidence, based on overlaps in technique, operational patterns, victims and infrastructure. According to the report, APT29 is widely attributed to Russia's Foreign Intelligence Service, while the exploits may have come from a third party. The compromised sites include a Ukrainian energy company, an American trade association, European political parties and Bulgarian military-related sites. When the report was published, it was still unclear whether the attackers were after visitors to particular sites or were trying to collect data from as many unpatched phones as possible.

Apple patched the iOS flaws Sekoia lists between May 2024 and February 2026, the last of them in iOS 26.3. The Chrome flaw was fixed in desktop Chrome 146 in March 2026, and the flaw Sekoia describes in the driver for Qualcomm's Adreno graphics chip appears among the Qualcomm components in the August 2025 Android Security Bulletin.

The chain aimed at iOS 16.7 uses two flaws, and according to Sekoia it should work from iOS 16.0 to 17.4. One of them, CVE-2024-27834, was fixed in iOS 16.7.8 in May 2024. The other, CVE-2025-43529, does not appear on any of the three Apple security content pages for iOS 16.7 that we checked, released between September 2025 and May 2026. The report gives no indication of whether the chain still works once one of the two is patched, so we cannot confirm its statement that "each flaw was resolved by the respective vendor before this campaign began" for this older line.

According to the descriptions of the video by Privacy Guides and MacRumors, the attacker starts the jailbreak (removing iOS restrictions to gain higher privileges) by sending a malicious PDF to the iPhone 18 Pro over AirDrop. The phone is then updated to iOS 27.2, and the jailbreak is still there afterwards. MacRumors adds that the file in the video was accepted by the user, and that it is unclear whether the jailbreak could be installed on a phone already running iOS 27.2. According to MacRumors, Calif had previously said it was disclosing the flaws to Apple and did not plan to release a jailbreak tool for ordinary users.

According to MacTrast's report, videos like this are easy to fake now that AI-generated video is widespread, and the jailbreak may have been in place before recording began. Separately from Calif's video, Apple's reply to TechCrunch on 27 March was that it was not aware of any device with Lockdown Mode enabled being compromised by mercenary spyware. The latest version listed on Apple's security releases page is iOS 27.2, released on 26 October, which predates Calif's video.

Perspective

Sekoia's campaign relied on n-day flaws, meaning flaws the vendor has already disclosed and fixed but that remain on devices that have not been updated, as opposed to zero-days the vendor does not yet know about. Whether an attack succeeds depends on which version the visitor's phone is running. On Apple's security releases page, keeping software up to date is described as one of the most important things you can do for your device's security. According to Google's Android help page, update schedules vary by device, manufacturer and mobile carrier, and older devices can't always run newer Android versions.

On an iPhone, updates are under Settings, General, Software Update, where Automatic Updates can also be turned on so the phone installs updates overnight while charging and connected to Wi-Fi. According to Apple's security releases page, as of 8 November the iPhone 11 and later can update to iOS 27.2. Apple has also released iOS 26.7.2 for an older system line and iOS 18.7.11 for the iPhone XS, XS Max and XR, all three on 26 October.

According to Google's help page, system updates on an Android phone are in the Settings app under System, Software updates, and the security update date is shown under About phone. Names may differ by manufacturer and interface language. Chrome is updated separately through the Play Store, under Manage apps & device. According to iThome's report, Sekoia urged users to update their operating systems and browsers as soon as possible.

According to Apple's support page, Lockdown Mode is designed for the very few people who, because of who they are or what they do, might be targeted by highly sophisticated attacks, and most people are never targeted in this way. With it on, most message attachments are blocked (certain images, video and audio excepted) and link previews are unavailable. Some websites may load slowly or not work properly, and the iPhone turns off 2G and 3G cellular support. Apple's guidance is to update to the latest software before turning it on, for a complete set of protections.

According to MacRumors' description, the attack in the video begins when the user accepts a PDF sent over AirDrop. From that condition we infer that not accepting AirDrop files from unknown senders avoids the scenario shown in the video. Since Calif has not published details, it is unclear whether other routes could achieve the same result, and Apple's page has no mention of Lockdown Mode restrictions on AirDrop or PDFs.

According to Google's help page, Android has a comparable Advanced Protection setting, which requires a screen lock before it can be turned on. It is under Settings, Security & Privacy, Other settings, Advanced Protection; once Device protection is on, Google Play Protect cannot be turned off, apps from unknown sources are blocked, and Chrome's JavaScript optimizer and WebGPU (an interface that lets web pages use the graphics chip directly) are disabled. The trade-offs are that Memory Tagging Extension (MTE) may slow the phone down and the phone may fail to connect to a cellular network where only 2G coverage is available. Google's page has nothing on whether these features would stop the chains Sekoia lists.

Calif's claim could not be verified as of 8 November, we found no response from Apple, and no update after iOS 27.2 was available to install. The next things to watch are whether Apple releases a fix or responds, and whether Calif publishes technical details. According to Privacy Guides, those details are likely to come only after Apple has released a patch and people have had time to install it.

When we checked on 8 November, we found no alert about Sekoia's campaign or Calif's video from the computer emergency response teams of Taiwan, Hong Kong or Japan. Taiwan's TWCERT/CC (Taiwan Computer Emergency Response Team / Coordination Center) listed CVE-2025-43529 in its weekly digest of the US Known Exploited Vulnerabilities catalogue on 24 December 2025, and CVE-2026-3910, the Chrome flaw, in the digest published on 19 March 2026. Hong Kong's HKCERT published a routine bulletin on Apple products on 27 October, covering a different flaw from those in this article. We found no entries for these flaws at Japan's JPCERT/CC and its vulnerability database JVN, or at mainland China's CNVD, whose search requires a login or JavaScript and returned nothing, though not finding them does not mean none exist.

For readers in mainland China, Apple's Simplified Chinese Lockdown Mode page, dated 18 September, carries the same description as the English page and mentions no regional restriction. The Chrome update route above runs through the Play Store, which GreatFire's measurements showed as 100% blocked in mainland China as of 1 November, a third-party test of whether the site can be reached. Google's Advanced Protection page lists no regional limits, and we found no official statement on whether it, or Google's update instructions, apply to Android phones sold in mainland China.

Anyone with a phone that has not been updated can check the version in Settings, and according to Sekoia's report, updating blocks the already-patched flaws used in this campaign. iPhone owners can compare against the three versions above, and those still on iOS 16 can update to iOS 16.7.16 (released 11 May 2026), the latest version we found for that line. We derived the Android comparison from the version ranges in the report: a security update date earlier than the August 2025 bulletin, or a Chrome version between 139 and 145, falls within the range the report lists. We could not find the Chrome for Android version that fixed the Chrome flaw.