This week a Russian intelligence group was caught stealing data from phones through poisoned websites. It used no zero-days. Every exploit in its three chains was for a flaw the phone makers had already fixed, one of them more than two years ago. The phones that were exposed weren't missing a patch nobody had released. They were missing updates nobody had installed.
What happened
Sekoia published the research on 4 November, attributing it with moderate to high confidence to APT29. Compromised websites, lookalike domains and a hijacked analytics script fingerprinted visitors and served exploit chains to iPhones and Android phones running older software, stealing cookies, saved logins, messages and Wi-Fi passwords. In Sekoia's words, "All three exploit chains rely entirely on known, already-patched vulnerabilities." CISA added one of the iOS flaws to its exploited list the same day. We cover the detection side in our threat research post.
Android had its own reminder this week: Google's November bulletin fixed a critical flaw that allows remote code execution with no user interaction, on Android 14 to 17. Phones only get it with the 2026-11-01 patch level, and only once the manufacturer ships it and the user installs it.
Our view: phones are endpoints, and they're your slowest-patched ones
Most organisations can tell you, within a day, what share of their laptops are on this month's Windows update. Ask the same question about phones and the answer is usually a shrug, or a figure from a dashboard nobody looks at.
That gap exists for understandable reasons:
- Ownership is unclear. Laptops belong to IT. Phones often belong to the user, or to a mobile contract managed by procurement, with a management profile added on top.
- Updates depend on the user. On a personal phone, IT can require an update but can't install it. On Android, it also depends on whether the manufacturer still ships updates for that model.
- Enforcement creates support calls. Block an outdated phone from email and the help desk hears about it in minutes. So the minimum OS setting gets left lenient, or never set.
Meanwhile, the phone holds a signed-in Outlook, Teams, the browser's cookie store and, often, the authenticator app. For an attacker, that is a Microsoft 365 session waiting to be lifted, and a phone with an old OS is the easiest place to lift it.
What to do about it
Decide who owns the mobile patch level
Write it down. Someone needs to report the share of phones on a supported, current OS each month, the same way they report laptops.
Set a minimum OS version and enforce it
Intune compliance policies let you set a minimum iOS and Android version and mark older devices non-compliant. Pair that with a Conditional Access rule that requires a compliant device, or approved apps with app protection policies on personal phones, for Microsoft 365. Give users a grace period and a clear message before access stops, so the support load is manageable. Raise the minimum as new releases arrive, not once a year.
Set an end-of-life rule for Android models
A phone that no longer receives security updates will never reach the patch level you need. Decide in advance when an unsupported model stops getting access to corporate data.
Keep sessions out of the browser
Encourage the Outlook and Teams apps over mobile web access, and use shorter sign-in frequency for browser sessions on unmanaged devices. The exploits in this campaign read the browser's cookie store.
Watch the identity side
You may never see the exploit on the phone. You can see what happens next in Entra ID: a session used from a new country, a mailbox rule created from an unfamiliar IP address. That is where most organisations will catch a stolen phone session.
The broader point
The comfortable story about advanced attackers is that they win with exploits nobody could have defended against. This campaign is the opposite. A well-resourced group chose old, fixed flaws because enough targets hadn't installed the fixes. The same is true of edge appliances and bundled libraries: the gap between a patch existing and a patch being applied is where most real attacks happen. Phones belong on that list.
How Wizard Cyber helps
Our vulnerability and patch management service gives you a regular view of where patches are missing, and our Microsoft security consultants can design Intune compliance and Conditional Access rules that raise the bar without flooding the help desk. Our SOCs, staffed 24/7, watch Entra ID sign-ins for the session misuse that follows a stolen phone.
If you'd like to know how many of your phones these exploits would have worked on, talk to our team.