APT29 Runs Watering-Hole Campaign Using N-Day iOS/Android Zero-Click Exploit Chains
Sekoia researchers report a large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 (Midnight Blizzard), targeting iOS and Android users through compromised legitimate sites and lookalike domains in the U.S., Ukraine, the Czech Republic, and Bulgaria. Victims visiting a Ukrainian gas producer, a U.S. chemical industry trade association, a Bulgarian military-related site, or fake pages impersonating America250 and Raffles London at The OWO were served JavaScript that profiled their device and browser before a C2 server delivered a platform-specific zero-click n-day exploit chain. The attackers also compromised the Ukrainian analytics service Plerdy, modifying its SEO tracker loaded by thousands of sites, mostly in Ukraine, between August 27 and September 3. The exploit chains extracted Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, Chrome cookies, login data, browsing history, and saved WiFi credentials, with no persistence established, meaning a device reboot halts the activity until the next visit.
Entenda a falha
A vulnerabilidade
The story covers eight n-day flaws chained in zero-click attacks, with no CVE-level technical detail in the articles. On iOS 16.7 the chain uses CVE-2025-43529 and CVE-2024-27834 to steal Safari cookies. On iOS 18.5 it uses CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to take WhatsApp and Telegram databases, Keychain credentials, location and photos. On Chrome for Android 139 to 145 (except 143), CVE-2026-3910 and CVE-2025-27038 are used with the AndroSnitch tool to take cookies, logins, history and saved WiFi credentials. The victim only needs to visit a booby-trapped site. Apple and Google have patched all of them, including backports to older iOS releases.
Como funciona
The victim opens a compromised legitimate site or a lookalike domain. The page serves JavaScript that profiles the device and browser version. That profile goes to a command-and-control server, which answers with the exploit chain matching the platform (iOS 16.7, iOS 18.5 or Chrome for Android), with no further user interaction. The chain then extracts cookies, messaging databases, Keychain items, location, photos, logins, history and WiFi credentials. None of the payloads set up persistence, so a reboot stops the activity until the next visit to a compromised site. The articles do not describe how each individual bug is triggered.
Por que é vulnerável
The articles do not give the root cause of any of the CVEs. What they do show is that these are n-days: the flaws were already patched by Apple and Google, and the attack works against devices and browsers that have not applied those updates. The fixes are the vendor patches, including those backported to older iOS releases.
Como foi descoberta
Sekoia researchers found the campaign and attribute it with moderate-to-high confidence to APT29 (Midnight Blizzard), citing similarities to past watering-hole operations, infrastructure overlaps and a compromised site a partner linked to a 2025 APT29 campaign. They also found that the Ukrainian analytics service Plerdy had its SEO tracker modified between August 27 and September 3. Sekoia identified four more vulnerabilities in unreachable code or alternate exploit paths that were not used in the analyzed chains. CVE-2025-43529 is tied to the DarkSword exploit kit, first documented in March and used by multiple groups since at least November 2025.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show working exploit chains used in real attacks by the actor tracked as APT29, delivered by a C2 server to matching iOS and Android devices. They also mention the DarkSword kit and the AndroSnitch tool, but none of them says that code was published. The exploits are therefore treated as private: seen only in attacks. Because they are in active use against unpatched iOS and Chrome for Android, patching is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 07:16.
Detalhes técnicos
On iOS 16.7: CVE-2025-43529 and CVE-2024-27834 target Safari cookies. On iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 harvest WhatsApp/Telegram databases, Keychain credentials, location, and photos. On Chrome for Android versions 139–145 (excluding 143): CVE-2026-3910 and CVE-2025-27038 are used alongside the AndroSnitch tool to collect cookies, login data, browsing history, and saved WiFi credentials. CVE-2025-43529 is linked to the DarkSword exploit kit, used by multiple threat groups since at least November 2025. Four additional vulnerabilities were found in unreachable code or alternate exploit paths but were not actively used. Attribution to APT29 is based on similarities to past watering-hole operations, infrastructure overlaps, and a compromised site a partner linked to a 2025 APT29 campaign.
Remediação
Apple and Google have patched all vulnerabilities exploited in this campaign, including fixes backported to older iOS releases. Users are advised to apply the latest available security updates for their iOS and Android devices.
Linha do tempo
-
APT29 Runs Watering-Hole Campaign Using N-Day iOS/Android Zero-Click Exploit Chains
ler a análise desta fonte ocultar
Sekoia researchers report a large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 (Midnight Blizzard), targeting iOS and Android users through compromised legitimate sites and lookalike domains in the U.S., Ukraine, the Czech Republic, and Bulgaria. Victims visiting a Ukrainian gas producer, a U.S. chemical industry trade association, a Bulgarian military-related site, or fake pages impersonating America250 and Raffles London at The OWO were served JavaScript that profiled their device and browser before a C2 server delivered a platform-specific zero-click n-day exploit chain. The attackers also compromised the Ukrainian analytics service Plerdy, modifying its SEO tracker loaded by thousands of sites, mostly in Ukraine, between August 27 and September 3. The exploit chains extracted Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, Chrome cookies, login data, browsing history, and saved WiFi credentials, with no persistence established, meaning a device reboot halts the activity until the next visit.
Technical Details
On iOS 16.7: CVE-2025-43529 and CVE-2024-27834 target Safari cookies. On iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 harvest WhatsApp/Telegram databases, Keychain credentials, location, and photos. On Chrome for Android versions 139–145 (excluding 143): CVE-2026-3910 and CVE-2025-27038 are used alongside the AndroSnitch tool to collect cookies, login data, browsing history, and saved WiFi credentials. CVE-2025-43529 is linked to the DarkSword exploit kit, used by multiple threat groups since at least November 2025. Four additional vulnerabilities were found in unreachable code or alternate exploit paths but were not actively used. Attribution to APT29 is based on similarities to past watering-hole operations, infrastructure overlaps, and a compromised site a partner linked to a 2025 APT29 campaign.
Remediation
Apple and Google have patched all vulnerabilities exploited in this campaign, including fixes backported to older iOS releases. Users are advised to apply the latest available security updates for their iOS and Android devices.