Hackers use n-day exploits in zero-click attacks on iOS, Android devices

Russian APT29 exploited known n-day vulnerabilities — flaws with existing patches — to silently compromise iOS and Android devices through watering hole attacks on legitimate and lookalike websites, requiring no user interaction whatsoever. The core failure was the gap between patch availability and patch deployment: both Apple and Google had issued fixes, but many users and organizations had not applied them, leaving devices exposed. Attackers were able to harvest cookies, credentials, and messaging app databases, demonstrating that even without establishing persistence, transient access can yield highly sensitive intelligence. This incident underscores that n-day vulnerabilities are operationally equivalent to zero-days when patching cadences are slow. Organizations must treat mobile device patch management with the same urgency applied to server and endpoint patching.