Hackers Exploit n Day Flaws in Zero Click Attacks on iOS and Android

What is a zero click attack?

Unlike traditional malware that requires a user to open a file or click a link, a zero click attack runs as soon as a device processes a specific data packet. The victim does not need to take any action, which makes detection extremely difficult.

Why n day vulnerabilities matter

An n day flaw is a known weakness that has already been disclosed or used in the wild. Because the vulnerability is public, patches may exist, but many users delay updates. Attackers exploit this window to gain access before the majority of devices are secured.

The recent watering hole operation

Security researchers have traced a large‑scale watering hole campaign to a group with ties to Russian intelligence services. The attackers compromised legitimate‑looking portals that provide services such as tax filing, travel booking, and government information. When a user visits one of these sites, the malicious code silently delivers a payload that exploits an n day flaw on the device.

Key characteristics of the operation include:

• Targeting both iOS and Android platforms with a single code base.
• Using zero click techniques that require no interaction.
• Leveraging known vulnerabilities that have been patched in recent updates.

How the attack chain works

1. Compromised website serves a hidden script embedded in a legitimate page.
2. The script checks the visitor's operating system and version.
3. If the device matches a vulnerable configuration, the script triggers an exploit that runs in the background.
4. The exploit gains a foothold, installs a downloader, and contacts a command and control server.
5. Additional payloads are delivered, ranging from credential harvesters to remote access tools.

Impact on iOS users

Apple’s iOS platform is often perceived as highly secure, yet the recent campaign demonstrates that zero click exploits can bypass many defenses. The attackers target a vulnerability in the WebKit rendering engine that was patched in iOS 17.3. Devices that have not installed the update are susceptible to remote code execution without any user interaction.

Apple regularly publishes security updates. Users can review the latest patches on the Apple security updates page. Keeping the operating system current is the most effective mitigation.

Impact on Android users

Android’s fragmented ecosystem provides a larger attack surface. The campaign exploits a flaw in the media framework that was addressed in the Android 13 security bulletin released in August 2024. Many devices, especially those running older versions or lacking manufacturer updates, remain vulnerable.

Google maintains a public Android security bulletin that details patches for each release. Users should enable automatic updates and verify that their device receives the latest security patches.

Why the attack is hard to detect

Because the exploit does not require user interaction, traditional anti‑malware solutions that monitor suspicious downloads often miss the activity. The malicious code runs in memory and may erase traces before the operating system logs the event.

Security experts recommend the following defensive measures:

• Apply operating system updates as soon as they become available.
• Use mobile device management tools that enforce patch compliance.
• Monitor network traffic for anomalous outbound connections to known command and control domains.
• Consider endpoint detection solutions that can inspect memory for known exploit signatures.

Broader implications for the cybersecurity landscape

The use of n day exploits in zero click attacks signals a shift toward leveraging publicly known vulnerabilities at scale. Threat actors no longer need to discover zero‑day flaws to achieve high‑impact compromises. Instead, they focus on rapid weaponization of existing code and on delivering it through stealthy vectors such as watering holes.

Researchers have mapped this behavior to tactics described in the MITRE ATT&CK framework, specifically the techniques "Exploitation for Client Execution" and "Drive‑by Compromise". Understanding these patterns helps defenders prioritize detection rules and threat‑intelligence feeds.

What organizations can do

Enterprises that manage large fleets of mobile devices should adopt a layered security approach:

1. Maintain an inventory of device models and operating system versions.
2. Implement a patch management policy that includes third‑party firmware updates.
3. Deploy web filtering solutions that block access to known malicious domains.
4. Conduct regular phishing and malicious‑website simulations to raise user awareness, even though zero click attacks bypass user interaction.

Guidance for individual users

While organizations can enforce policies, everyday users also play a crucial role. Here are practical steps to reduce risk:

• Enable automatic updates for both iOS and Android devices.
• Avoid installing apps from unofficial sources.
• Regularly review app permissions and revoke those that are unnecessary.
• Use a reputable mobile security app that offers real‑time protection and vulnerability scanning.

Staying informed about recent security advisories from official sources such as US‑CERT can also help users act quickly when new threats emerge.

The evolution of zero click attacks underscores the importance of a proactive security mindset. By keeping devices updated, monitoring network behavior, and following best practices, both individuals and organizations can limit the damage caused by sophisticated watering hole campaigns that exploit n day vulnerabilities.