Hackers Target iPhone, Android Users Via Fake Sites
A watering-hole campaign compromised legitimate websites and built lookalike domains to infect visitors' phones with malware.
Updated on Nov. 4, 2026 in Cybersecurity
Live Poll
Do you trust that websites you visit on your phone are safe?
Sekoia uncovered a campaign in mid-October 2026 in which attackers targeted iPhone and Android users visiting compromised or fake websites tied to organisations in the United States, Ukraine, the Czech Republic and Bulgaria. Sekoia published its findings on November 4, 2026.
Why it matters
The campaign shows attackers using trusted websites as a delivery route to reach specific visitors, a method that can be hard for individuals to detect. Its reliance on previously disclosed flaws underscores the importance of timely software updates.
Attackers modified the Plerdy web analytics tracking code between August 27 and September 3, 2026, and exploited flaws in older iOS and Chrome-for-Android versions. Researchers have not established how many devices were compromised.
The players
Sekoia
Sekoia is a cybersecurity company whose researchers uncovered and published findings on this watering-hole campaign.
The details
Attackers used three methods: compromised legitimate websites, fake domains impersonating well-known organisations such as copies of the America250 initiative and Raffles London at The OWO hotel, and a hijacked website analytics service. Malicious code identified each visitor's device and browser version before delivering tailored attacks.
Timeline
August 27 to September 3, 2026: Attackers modified the Plerdy analytics tracking code.
Mid-October 2026: Sekoia uncovered the campaign.
November 4, 2026: Sekoia published its findings.
The Tech Race
Watering-hole attacks have long been used against narrowly targeted groups, and this campaign extends that model by compromising a widely used analytics service. It shows attackers exploiting the shared software layer that many websites depend on.
Keeping iPhone and Android software updated closes the previously disclosed flaws this campaign relied on. Be cautious when visiting unfamiliar sites, especially lookalike domains of well-known organisations.
The takeaway
Software updates remove the flaws that attacks like this depend on, so installing them promptly is one of the most effective protections. Verify that a website's domain matches the organisation it claims to represent before entering information.
Further reading
Explore more on Cybersecurity to see how watering-hole attacks fit into broader defensive practices.
Source note: This article includes information reported by GULF NEWS.
Live Poll
Do you trust that websites you visit on your phone are safe?
