# Hackers use n-day exploits in zero-click attacks on iOS, Android devices

> **Open Intelligence Dossier** · First detected: 2026-11-04 13:20 UTC · Category: Technology

## Executive Summary
Hackers target iOS and Android devices in zero-click attacks using n-day exploits and Instagram ads.

## Intelligence Brief
Recent technology reporting outlines a coordinated wave of mobile security threats involving zero-click attacks, n-day exploits, and malicious software deployments targeting both iOS and Android devices. According to specific coverage from BleepingComputer, hackers are actively leveraging n-day exploits to compromise mobile operating systems without requiring any user interaction. Additional reports from outlets such as Pasquale Pillitteri and ShiftDelete.Net detail how specific malicious payloads, identified as the DarkSword spyware and the P7 DarkSword variant, are successfully reaching vulnerable iPhones running outdated versions of the iOS operating system. The distribution methods highlighted in the current reporting indicate sophisticated vector choices by threat actors. Coverage from Pasquale Pillitteri points directly to Instagram ads as a delivery mechanism for the DarkSword spyware targeting iPhones.


Simultaneously, reporting by GovInfoSecurity attributes parallel mobile device targeting to Russian intelligence hackers who are trolling mobile devices specifically to harvest login cookies. Coverage across GlobalInfo.az reinforces these concerns by issuing important warnings directly to iPhone users regarding the heightened risks currently facing vulnerable hardware configurations and outdated software builds across the broader consumer landscape. This emerging trend builds upon established cybersecurity concerns regarding the vulnerability of mobile ecosystems to zero-click exploits, which bypass traditional security awareness defenses by requiring no deceptive user actions like clicking malicious links. The specific involvement of advanced threat groups, such as the Russian intelligence actors reported by GovInfoSecurity, places these mobile campaigns within a broader context of state-sponsored cyber espionage and persistent credential-harvesting operations. Outdated software versions running on iPhones and Android devices remain a central vulnerability factor across the analyzed reports, creating distinct pathways for spyware delivery mechanisms like DarkSword and P7 DarkSword.


As the situation develops, ongoing coverage suggests several key focal points for monitoring future developments in mobile security. Observers will be tracking whether additional app platforms beyond Instagram are utilized for spyware delivery, how quickly device manufacturers and operating system developers issue patches for the exploited n-day vulnerabilities, and whether further details emerge regarding the scope of the login cookie harvesting operations conducted by Russian intelligence hackers. Current reporting does not yet specify the total number of compromised devices or the precise remediation timelines established by affected platform providers.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| CyberSecurityNews | Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users | [Source Link](https://news.google.com/rss/articles/CBMiYkFVX3lxTFBRcUIwNTRBWnVWM3pMWWhNbTRza1RZX1Brd21TTWJ6dzd1WmpzWDFPZW9sbzMyckY2U2M5RnVOTDFXVUJ1cG5tMVZaTFFCWXh6M1VNdXFOeEJ1eUVnN3hRMFFn0gFnQVVfeXFMTXRUelJWU1pES3NNamJVZUFKRUNqVGpWdlJ5ZjNqSDRnMjhrZnFMdlN1UmhEdkxmTHNmMGVPczRCc2ZGMmVhamVac1JpMXc1MWhIajVCNmRjYUtvVEZVa3doNVRXc2tjQQ?oc=5) |
| The Hacker News | APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits | [Source Link](https://news.google.com/rss/articles/CBMiekFVX3lxTE9ldjNRckVDYzhzNU8zOWdiSFY0VXQwSkl4dXpaMjdmN1g0Y1RnWXU0WkFYMjFadkZQVmlhZW83bkpvVFJSXy1aM25SYW96dzFiM2VZb0ZYZURHTGJUZGV1VVpTbzNmRHR6RUc1MDdxYlVBU3NMVlY3b3Nn?oc=5) |
| BankInfoSecurity | Russian Intel Hackers Troll Mobile Devices for Login Cookies | [Source Link](https://news.google.com/rss/articles/CBMiowFBVV95cUxPeW5FeHYzd2llM3U5R1U3Z2ZsQk1jT29kNWpzb1AzcmtjTWU1SXZBcUpxWXNYdHJ5R2ZJWm9KZk9ZYW9Wb1dFaWp0emhQMnV0MjlBWjJPeFNoQ0plV0JBUGRkUUhja3pVREtjdFBOeDJNZlU4aGI4ZHpPMlV1TU9TOHFEdUhRUTZNM1plQnBlVVltTm5pbGNBUjBiOTBlWGMxakxJ?oc=5) |
| Infosecurity Magazine | APT29 Watering Holes Target Unpatched iPhones and Android Devices | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTFB0VUFrWGFGQTh1ejJNQTNUS1FvaS1ZeDh3bzlxOXA0VFNScFFPbC13NTZsMnhFT2dhTzdGZXlBelF6NnBIT0ZsQUpzNFlaVEZTRzAtaFdwcXFYN3ZiV3RhdTZwUlhaeGl2bnF6TVFsdHVhd1pxRUs3N01ockQ?oc=5) |
| Pasquale Pillitteri | Instagram Ad Delivers DarkSword Spyware to iPhones Running Outdated iOS | [Source Link](https://news.google.com/rss/articles/CBMimgFBVV95cUxON1pRdjhyWDQ3bjlNV2U4MTh1ZzdkU1dORFVhMGlOQmdUT2dxMzJJczBPYjBKNU9HVTZ1a1FDOERjOE9xUmltbklKMGc0OFlPNnQyblE5MTdQTEdfMGNPZmZtMm56b2dLWUo0UlRGWEJJZW1XM1pvS0p6QlpCeVBqa2ZscUp6UUJNalZZb0JieFFabmlRU1g1Wkdn?oc=5) |
| GovInfoSecurity | Russian Intel Hackers Troll Mobile Devices for Login Cookies | [Source Link](https://news.google.com/rss/articles/CBMiogFBVV95cUxOUEM1eXNaN3dDMm5PeHdnS2JsMThtbG9Qc0ZFZEx2ZEdZMFM0NVBjdWNWaGM2MEc0a1B4SGMtZWhrRmdRRE9TU1ZNYnhLUGlraHdadVlmTHZ3ZWI0TkdReVBDY3VqSF8xYUZteVZHQ2tCNmZnWUlGT2NmREtsVk54eUZhMUx2UmZKaThaOExySGFXS01GaElyU09TbEw4bVNuMXc?oc=5) |
| ShiftDelete.Net | New P7 DarkSword Spyware Threatens Vulnerable iPhone Devices | [Source Link](https://news.google.com/rss/articles/CBMikAFBVV95cUxQZHdfZUJrV0thcEpnR3dlUzhwUU5XQ28zdnBXUkF5V3dhNDRoQU82OVBjcm5JMFZOZ25obEEyNng2NG1TTlZYN0Z3anhWYlY5elFZaHBVX3NLZVVacUJwQlIydkFmUVNFc1U5U2pCYnJMTmVkOHFMZHdZdFR3Q3VPbnY2SWc3RVVBZkJSRmFLbWw?oc=5) |
| GlobalInfo.az | Important warning for iPhone users — do this immediately | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTFB2TlBocXVCQURndV8wa1FLbURRbGhYRmQzRG05ZTAzWEU3SEFtOVZHVTQ2Qk8tTWk0Mi1tVWlqMW9UN0VBOEFzMWRGZm5vU24tYjlvYTJaTzlwQUVOMFRnYVkwbk5jcDdBbFE2SDRCVU0xNllYOWxWMEVYTmM?oc=5) |
| BleepingComputer | Hackers use n-day exploits in zero-click attacks on iOS, Android devices | [Source Link](https://news.google.com/rss/articles/CBMiuwFBVV95cUxOQTVyN3BYZExIYUdHdUl4NDh1TnNMLUE2TXByTmtJLTVWTy1WUVhlZGNJaEZILVYwZVVLZFQ3WUpCRFkxZ01UaUJfWXJEOWJxYjV2UHAxZzEybUJMNHpycTRMT0I0d2wxM19TczJYU3dXNGtVLWdhMTJrZjZSQkU3VUtTTTNQZmdUZ1A5bU1FSHdJZ1Fnb1pWaWRVb1A2VTZ2WUVWbUYzTE5hMHdFWlFDamNmQ0gta1lZSkJZ?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-11-04/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices*