"Don't click anything" is dead advice: patching is your real shield

For years the standard security advice was simple: don't click suspicious links, don't download strange apps. What do you tell people when merely loading a normal page can be enough?

That is the uncomfortable lesson of a campaign described by French security firm Sekoia. According to eSecurity Planet's summary of the November 4 report, the operation was linked with moderate-to-high confidence to APT29, a group associated with Russia's foreign intelligence service. Attackers injected malicious JavaScript into legitimate sites, including a Ukrainian gas producer, a US chemical industry trade association and a European political party. They also registered lookalike domains and tampered with a Ukrainian analytics provider's tracker. The script profiled the visitor's browser and operating system, and vulnerable devices received exploits automatically, with no extra clicks or downloads.

The detail that matters most is this: every recovered exploit chain relied on vulnerabilities that had been patched before the campaign began. Fully updated devices were protected against these specific attacks. As BFMTV reports, Apple had shipped a fix for the flaw used by the DarkSword toolkit last April.

Your caution was never the weak link, your update lag was

Telling users to "be careful" assumes the danger is visible. Here it wasn't: the lookalike sites showed content pulled from the legitimate originals, and the other attacks hid inside real sites. No amount of vigilance helps when the malicious code sits inside a site you have good reason to trust.

What did work was boring. Installing the patch. In our view, that makes the old advice not just insufficient but misleading, because it puts the burden on behavior users can't control and neglects the one thing they can: update status. To be fair, this campaign looks targeted. Sekoia suggests diplomatic delegations and high-profile guests may have been the aim, and investigators couldn't establish how many devices were compromised. Most readers are probably not the intended victims. But tools like this tend to spread, and the defense is the same either way.

Android shows why "just update" is not a fair ask

On iPhone, the answer is easy to give. On Android it is messier. 01net notes that Google's November patch fixes 216 flaws, 23 of them critical, including one in the Framework that needs no user interaction. The same article says more than 40% of active devices run Android 13 or older and no longer get security updates from Google. For everyone else, timing depends on the manufacturer adapting the fix: a few days for some, several weeks for others.

That is the real scandal. We tell people to patch quickly, then sell them devices on which patching is somebody else's schedule. A user can do everything right and still be exposed for weeks. We think that's a design failure of the ecosystem, not a user failure.

Vendors should make patching invisible

Our position: security updates should install themselves, quickly, and restart-free where possible, with the burden on the vendor. Apps and handsets that nag users to "update later" are shipping a vulnerability with a snooze button. Manufacturers who lag behind Google's bulletins should be named and compared publicly on speed, and buyers should treat update commitments as a spec as important as the camera.

One caveat from the research: none of the chains established persistence, but, as the report notes, restarting a phone wouldn't undo data theft. Session hijacking can also give attackers access to accounts without touching a company network. So updating after the fact is not a cure.

Check your phone today, and treat patch speed as a spec

On Android, open Settings, About phone and look at the security update date: 01net says November 1, 2026 or later protects against the critical Framework flaw. On iPhone, install the latest iOS. Turn on automatic updates everywhere. If your phone no longer gets patches, treat that as a replacement date, not a suggestion. And if you're choosing a new one, ask the seller how long and how fast it will be patched. That question protects you more than any warning about links.