Russian hackers have targeted iOS and Android users across the United States, Ukraine, the Czech Republic, and Bulgaria with zero-click n-day exploit chains. Cybersecurity researchers at Sekoia trace the watering-hole campaign with moderate-to-high confidence to APT29, also known as Midnight Blizzard.
Threat Actors Compromise Legitimate Websites and Domains
The malicious operation relied on high-profile infrastructure to deliver its initial payload. Sekoia identified compromised legitimate sites including a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. Attackers also set up lookalike domains impersonating the official America250 site and Raffles London at The OWO hotel, using an adversary-in-the-middle model to relay content from the real portals.
Between August 27 and September 3, the threat actors compromised the Ukrainian web analytics service Plerdy and modified its SEO tracker. Thousands of websites, predominantly in Ukraine, loaded the modified tracker during that window.
Hackers Deploy Profiling Scripts
Visitors to the compromised or fake portals loaded an initial JavaScript payload designed to profile their devices and browser versions. A command-and-control server then pushed the specific exploit chain matching the target. The attack required no user interaction after the initial visit.
platform-specific n-day exploit chains without user interaction.
Sekoia
The payloads targeted multiple vulnerabilities depending on the operating system and version. For iOS 16.7, the attackers exploited CVE-2025-43529 and CVE-2024-27834 to extract cookies stored in Safari. For iOS 18.5, the payloads used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to harvest WhatsApp and Telegram databases, Keychain credentials, location data, and photos. For Chrome on Android versions 139 to 145, excluding 143, the operation used CVE-2026-3910 and CVE-2025-27038 alongside AndroSnitch to collect cookies, login data, browsing history, and saved WiFi credentials. Researchers also identified four other vulnerabilities located in unreachable code or alternate exploit paths that were not utilized in the analyzed chains.
Campaign Links to Exploits
One of the targeted vulnerabilities, CVE-2025-43529, is linked to the DarkSword exploit kit, which was first documented in March and has been used in attacks since at least November 2025 by multiple threat groups.
Researchers noted that none of the payloads deployed by APT29 established persistence on the infected devices. A simple reboot stopped the malicious activity until the user visited a compromised site again.
Sekoia based its attribution to APT29 on behavioral similarities to past watering-hole operations conducted by the group, overlapping infrastructure, and a compromised site linked by a partner to an APT29 campaign in 2025. Apple and Google have issued patches for all flaws targeted in the campaign, including fixes extending to older iOS releases. Users are advised to apply the latest available security updates.