A reported Russia-linked cyber campaign has used watering hole attacks to target iOS and Android devices through exploit chains delivered from compromised websites. According to the source report, the activity affected entities in the US and Europe, with much of the targeting focused on Ukraine. Although technical details in the source are limited, the incident highlights a practical risk for European organisations: employees can be exposed through trusted websites on mobile devices, not only through email or direct malware downloads.

What happened

Security reporting indicates that attackers linked to Russia carried out a large-scale watering hole campaign. In a watering hole attack, a threat actor compromises a website that the intended target is likely to visit and then uses that site to attempt device compromise.

In this case, the campaign reportedly targeted both iOS and Android devices using exploit chains. An exploit chain typically combines multiple software vulnerabilities or attack techniques to gain access, escalate privileges or execute malicious code on a device.

The reported targeting included entities in Europe and the United States, with a primary focus on Ukraine. The source does not establish that all visitors were compromised, but it does indicate a broad campaign with cross-platform mobile relevance.

Why it matters for European businesses

For European businesses, the key issue is that mobile devices are part of the corporate attack surface. Staff often use smartphones and tablets to access email, collaboration tools, CRM systems, cloud storage, banking apps and internal dashboards. If a device is compromised, attackers may gain a foothold into wider business systems or access sensitive data.

Watering hole attacks are also harder to spot than standard phishing because they abuse websites users may already trust. This makes them relevant for companies with remote teams, travelling employees, executives, sales staff and operational teams that rely heavily on mobile access.

The incident is particularly relevant in a European context because organisations connected to Eastern Europe, cross-border operations, NGOs, media, logistics, public-interest sectors or businesses with activities related to Ukraine may face elevated exposure. However, the broader lesson applies more widely: mobile endpoint security should not be treated as separate from mainstream business cybersecurity.

Who may be affected

• Businesses operating in or near Ukraine, or working with Ukrainian partners, suppliers or institutions
• European companies with employees travelling internationally or accessing business systems from mobile devices
• SMEs without formal mobile device management or mobile threat monitoring
• Executives and high-value staff whose devices provide access to sensitive communications or systems
• IT and security teams responsible for BYOD, corporate smartphones and SaaS access controls

What companies should consider

• Review mobile patching processes for both iOS and Android devices, including corporate-owned and bring-your-own-device environments where allowed
• Check mobile device management and access controls to ensure business applications and data can be restricted or remotely managed if a device is suspected to be compromised
• Apply least-privilege access so that a compromised mobile device does not automatically expose wider company systems
• Monitor threat intelligence relevant to your region and sector, especially if your organisation has links to Ukraine or operates in higher-risk geopolitical environments
• Review browser and web security controls, as watering hole attacks rely on users visiting compromised sites rather than responding to obvious phishing messages
• Strengthen incident response plans for mobile endpoints, including device isolation, credential resets and review of session tokens for cloud services
• Educate staff that visiting a known or legitimate-looking website does not always eliminate risk, especially during periods of heightened geopolitical cyber activity

While the source report does not provide full technical indicators or victim numbers, the campaign is a useful reminder that advanced attackers continue to target mobile platforms as part of broader intrusion activity. For European businesses, especially those with exposed regional ties or limited mobile security controls, the practical takeaway is clear: smartphones should be treated as critical business endpoints, not secondary devices.