A reported large-scale cyber campaign has used previously disclosed mobile vulnerabilities in attacks against iPhone and Android users, according to BleepingComputer. The activity is described as a watering hole operation, meaning attackers allegedly compromise legitimate websites or create convincing lookalike sites in order to target visitors. For businesses, the development is a reminder that even older, known vulnerabilities can remain highly dangerous when patching is delayed and employees access business systems on mobile devices.

What happened

According to the report, attackers linked to Russia have targeted mobile users through compromised websites and fake portals impersonating legitimate services. The campaign reportedly affected both iOS and Android devices and used n-day exploits, meaning vulnerabilities that were already known and had patches or mitigations available.

The report also describes the attacks as zero-click. In practical terms, that means a victim may not need to open an attachment or complete a typical phishing step for exploitation to begin once the malicious content is delivered through a visited site or related attack chain. While technical details may continue to emerge, the reported combination of watering hole tactics and mobile exploitation is notable because it reduces the amount of user interaction normally needed for an attack to succeed.

Why it matters for European businesses

Many European SMEs and larger organisations now depend on smartphones for email, collaboration tools, authentication apps, CRM access, approvals, banking and customer communications. That makes mobile compromise a direct business risk, not just an end-user security issue.

If attackers can exploit devices through trusted or trusted-looking websites, the exposure goes beyond a single employee mistake. A compromised mobile device could potentially give criminals access to business email, messaging platforms, saved credentials, multifactor authentication workflows or sensitive customer information, depending on how the device is configured.

The use of n-day exploits is also important for business leaders because it shifts attention from highly sophisticated unknown flaws to a more operational problem: patching discipline. If a vulnerability is already known, organisations may be able to reduce risk significantly through faster device updates, mobile device management controls and tighter access policies.

There is also a web-security angle. Watering hole attacks rely on trusted online destinations. For companies operating customer portals, partner logins or high-traffic content sites, website compromise can turn a business asset into an attack vector affecting employees, customers or suppliers.

Who may be affected

• SMEs using mobile-first workflows
  Businesses that rely on phones for approvals, messaging, email and sales activity may be especially exposed if updates are inconsistently applied.
• Organisations with BYOD policies
  Bring-your-own-device environments can make it harder to confirm patch status, enforce secure browsing controls or isolate business data.
• Companies with field staff or executives travelling frequently
  Employees who regularly access portals, webmail and internal tools from mobile devices present a larger attack surface.
• Businesses running public-facing websites and portals
  If attackers compromise legitimate sites or imitate them convincingly, both internal users and customers may be put at risk.
• IT and security teams in regulated sectors
  Any mobile compromise involving personal data, credentials or internal systems may create wider compliance, incident-response and operational consequences.

What companies should consider

• Review mobile patching speed
  Check whether iOS and Android devices used for work are updated promptly and whether unsupported devices are still in use.
• Strengthen mobile device management
  Use MDM or equivalent controls to enforce update policies, application rules, device compliance checks and remote response measures where appropriate.
• Limit access from non-compliant devices
  Consider conditional access policies so devices that are outdated, rooted or otherwise non-compliant cannot reach sensitive business services.
• Audit website and portal security
  Because watering hole attacks depend on trusted web destinations, organisations should review CMS security, third-party scripts, admin access, hosting controls and monitoring for signs of compromise.
• Reassess BYOD risk
  Where staff use personal phones for work, confirm what corporate data is stored locally, how access is separated and what the minimum security baseline should be.
• Prepare incident response for mobile compromise
  Teams should know how to revoke sessions, reset credentials, rotate tokens and investigate potential exposure involving email, messaging or cloud accounts.
• Remind users to verify web destinations
  Although zero-click elements reduce reliance on classic phishing interaction, fake portals and impersonation still make domain verification and secure browsing practices important.

For European businesses, the main lesson is practical: known vulnerabilities on mobile devices can still lead to serious compromise when patching lags and website trust is abused. Companies that treat smartphones as core business infrastructure should review both mobile security controls and the security of the web properties their staff and customers rely on.