A watering-hole campaign attributed with medium to high confidence to the Russian threat group APT29 is targeting iOS and Android users through compromised websites and fake portals. The operation profiles visitors’ devices and browsers before delivering platform-specific n-day exploit chains without requiring user interaction, potentially exposing cookies, messaging databases, credentials, location data and photos.
Researchers at cybersecurity firm Sekoia linked the campaign to APT29, also known as Midnight Blizzard. The group has recently been associated with attacks involving hotel Wi-Fi networks.
Compromised websites target mobile users
The campaign used legitimate websites in the United States, Ukraine, the Czech Republic and Bulgaria to deliver the same initial payload. The compromised sites included those belonging to a Ukrainian gas production company, a U.S. chemical industry association and a Bulgarian military website.
Attackers also created lookalike domains impersonating the official America250 website and OWO Hotel Raffles London. These domains relayed content from the legitimate sites using an adversary-in-the-middle attack model.
Between August 27 and September 3, the attackers also compromised Plerdy, a Ukrainian web analytics service. They modified the SEO tracker loaded on thousands of websites, primarily in Ukraine.
In each case, the first-stage payload was JavaScript that built a profile of the visitor and identified the device and browser version in use. The command-and-control (C2) server then delivered the exploit chain appropriate for that platform.
Source: Sekoia
Exploit chains target iOS and Android data
According to Sekoia, the attackers used the following vulnerabilities to extract cookies, messaging application databases and credentials:
- iOS 16.7: CVE-2025-43529 and CVE-2024-27834. The payload targets cookies stored in Safari.
- iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. The payload collects WhatsApp and Telegram databases, keychain credentials, location data and photos.
- Chrome for Android versions 139 to 145, except version 143: CVE-2026-3910 and CVE-2025-27038. The attackers used AndroSnatch to collect Chrome cookies, login data, browsing history and saved Wi-Fi credentials.
Researchers identified four additional vulnerabilities in unreachable code or alternative exploit paths, but those flaws were not used in the exploit chains analyzed.
CVE-2025-43529 is associated with the DarkSword exploit kit, which was first documented in March and has been used by multiple threat groups since at least November 2025.
No persistence found in the analyzed payloads
Sekoia said that none of the APT29 payloads observed in the campaign established persistence. Restarting an affected device can therefore stop the malicious activity until the user visits a compromised website again.
Sekoia attributed the operation to APT29 based on similarities to the group’s previous watering-hole campaigns, overlapping infrastructure and compromised websites that partners have connected to an APT29 campaign from 2025.
Users should install the latest security updates
Apple and Google have patched all of the vulnerabilities targeted in this campaign. The fixes are also available for older iOS releases, so users should install the latest security updates available for their devices.
Source: www.bleepingcomputer.com