A large-scale watering-hole campaign attributed with moderate-to-high confidence to Russia-linked APT29 has targeted iOS and Android users through compromised websites and lookalike portals, delivering already-patched exploit chains that can steal cookies and sensitive device data without user interaction, researchers at Sekoia reported on November 4.
The operation used three routes: injecting code into legitimate websites, routing visitors through fake domains that impersonated trusted sites, and compromising a Ukrainian web analytics service. Sekoia identified compromised sites belonging to a Ukrainian gas producer, a U.S. chemical industry association and a Bulgarian military-related organization. Lookalike domains also impersonated the America250 initiative and Raffles London at The OWO.
Between August 27 and September 3, attackers also tampered with the Plerdy SEO Tracker script, exposing hundreds of legitimate websites, mostly in Ukraine, to the malicious loader. The script profiled visitors’ devices and browser versions before the attackers selected an exploit chain. One iOS chain used DarkSword, an exploit kit also described in Abijita’s coverage of DarkSword attacks targeting iPhone data.
Sekoia identified chains targeting iOS 16.7 with CVE-2025-43529 and CVE-2024-27834, and iOS 18.5 with CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. The Android chain targeted Chrome versions 139 through 145, except 143, using CVE-2026-3910 and CVE-2025-27038. Payloads sought Safari cookies, broader iPhone data, and Android Chrome cookies, login data, browsing history and saved Wi-Fi credentials.
The researchers said every vulnerability used in the campaign had been patched before the operation, making the attacks n-day exploitation rather than zero-days. The payloads did not establish persistence. Sekoia attributed the campaign to APT29, also known as Midnight Blizzard or Cozy Bear, based on technical overlaps, infrastructure and targeting patterns, and said it was coordinating with affected countries’ computer emergency response teams.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
