Russian hackers target iOS and Android users with n-day exploits

Russian state-sponsored group APT29 leveraged n-day exploits — vulnerabilities that have already been patched but remain unaddressed on victim devices — to compromise iOS and Android users across multiple industries. The campaign succeeded precisely because organizations and individuals failed to apply available security patches in a timely manner, leaving known attack surfaces open. By hijacking analytics services and using lookalike domains, the attackers amplified their reach without needing zero-day capabilities. This incident underscores that patch lag, not just zero-days, represents one of the most exploited weaknesses in modern threat campaigns and can have severe consequences including theft of credentials, messages, and sensitive network data.