Hackers infect smartphones through legitimate websites. You no longer need to download anything to get infected.

You click on a well-known news site, and in that instant, your phone is compromised. No downloading of suspicious files or confirming warning pop-ups. The latest campaign by Russian hackers shows why standard mobile antivirus software can’t catch everything and why delaying system updates is a huge risk.

In early November, security analysts uncovered a massive cyberattack campaign orchestrated by state-sponsored hacker groups from Russia. It targets owners of both iOS and Android smartphones, with the attackers employing an extremely insidious tactic. They can infect a device with malicious code simply by having the user visit a completely ordinary—yet secretly compromised—website.

This technique, known as a “watering hole” attack, completely changes our understanding of how an ordinary user can become infected online.

How does a “watering hole” attack work?

The name of this attack comes from nature—specifically, from the tactics of predators who don’t chase their prey across the savanna but wait at a watering hole, where animals regularly go to drink.

In the digital world, this means that hackers do not send victims phishing emails or force them to install fake apps. Instead, they compromise a legitimate website that the target audience visits regularly. This could be a news portal, a discussion forum, a local government website, or a hobby blog.

The attackers silently inject a malicious script into the website’s code. When an unsuspecting user opens the site on their smartphone, the script runs in the background and attacks the browser.

Which websites are at risk?

In similar state-sponsored campaigns, hackers do not target global giants like Google or Facebook, as these companies have massive security teams. Instead, they choose smaller but locally significant European websites—such as regional media outlets, websites of non-governmental organizations, or government institutions. For security reasons and due to the ongoing investigation, complete lists of compromised European domains are not being published at this stage, but the attacks also directly affect users in our region.

No downloads required: Infection occurs completely silently

The most dangerous aspect of the current campaign is the exploitation of so-called zero-click and n-day vulnerabilities.

In practice, this means that the user does not need to click on anything on the compromised website, confirm anything, or even download any files. Simply loading the infected page in a browser (such as Chrome or Safari) is enough for the script to exploit an unpatched vulnerability in the browser’s core.

Once attackers manage to breach the browser’s defenses, they gain access to the device. They can track the user’s location, read messages, access passwords, or install spyware on the phone. Since the infection occurs in a fraction of a second in the background, the user has no way of knowing that anything has happened.

How can you actually protect yourself?

Since the attack occurs through legitimate websites and doesn’t require any incorrect interaction on your part, classic advice like “don’t click on suspicious links” simply doesn’t work here. Protection lies solely in maintaining your device.

Here are three key steps you must take:

1. Update your operating system immediately: Whether you have an iPhone or an Android, attackers in these types of campaigns exploit known vulnerabilities (zero-day vulnerabilities) for which manufacturers have typically already released a patch, but users haven’t installed it yet. Check your settings for the latest update and don’t put it off.
2. Update your web browser: If you use Google Chrome, Firefox, Opera, or another browser downloaded from an app store, make sure you have the latest version. For Safari (iOS), fixes come directly with system updates.
3. Restart your smartphone regularly: Some modern tracking programs cannot survive a device restart (so-called “in-memory malware”). Although this won’t prevent the initial intrusion, regularly turning your phone off and on (for example, once a week) can cut off attackers’ ongoing access to your data.

Standard mobile antivirus software often won’t protect you from a sophisticated attack that targets system vulnerabilities directly. The only truly effective defense is to keep your smartphone’s software completely up to date.