Russian state-sponsored hackers deployed known n-day vulnerabilities in zero-click watering hole attacks against mobile devices visiting legitimate and spoofed websites, cybersecurity firm Sekoia reported on Tuesday. The operation targeted visitors across the United States and Europe using tailored exploit chains that required no interaction from device owners.
Key points
- Attackers linked to Russian intelligence group APT29 compromised high-profile sites and analytics scripts to profile mobile visitors.
- Targeted devices running unpatched versions of iOS and Android received zero-click exploits through web browsers.
- The malware harvested authentication cookies, Keychain credentials, location history, and message databases from WhatsApp and Telegram.
- Infiltrations lacked persistence mechanisms, meaning infected phones lost the malicious code after a standard system restart.
How the watering hole campaign worked
The campaign relied on strategic web compromises to deliver malware silently. Threat actors injected malicious JavaScript into legitimate websites belonging to a Ukrainian gas producer, a Bulgarian defence organisation, and a trade association for the United States chemical sector.
Alongside compromised authentic portals, the attackers established lookalike web addresses. These mirrored the America250 national celebration site and Raffles London at The OWO, a luxury hotel in Whitehall. The spoofed domains operated an adversary-in-the-middle proxy, relaying authentic pages while inspecting incoming traffic.
The operation also achieved wide distribution by tampering with Plerdy, a Ukrainian digital marketing and search engine optimisation service. Between 27 August and 3 September, attackers altered an analytics script that loaded across thousands of Ukrainian websites.
When a phone loaded any of the compromised pages, the malicious JavaScript gathered browser details and operating system specifications. This device fingerprint travelled to an external command server, which chose an exploit payload matching the victim’s software version.
Exploit chains targeting iOS and Android
In a technical report on the campaign, Sekoia attributed the activity to APT29 with moderate to high confidence. The group, also tracked as Midnight Blizzard, works on behalf of Russia’s Foreign Intelligence Service.
Instead of relying on rare zero-day flaws, the attackers weaponised n-day vulnerabilities. These security defects were already publicly documented and fixed in newer software builds, but remained dangerous on devices running delayed system updates.
For older Apple devices running iOS 16.7, the attackers chained CVE-2025-43529 and CVE-2024-27834. Once triggered in the Safari browser without user intervention, the script extracted authentication cookies from active web sessions.
On handsets running iOS 18.5, the threat actors chained five separate security flaws to compromise the operating system. By combining CVE-2025-43510, CVE-2025-14174, CVE-2025-43520, CVE-2026-20700, and CVE-2025-43529, the script extracted local WhatsApp and Telegram databases, device photographs, Apple Keychain credentials, and real-time geographic coordinates.
Android phones running Google Chrome versions 139 to 145, excluding release 143, faced a separate exploit chain using CVE-2026-3910 and CVE-2025-27038. This deployed an information-stealing payload known as AndroSnitch, which took Chrome browsing history, saved login credentials, cookies, and stored Wi-Fi network passwords.
The role of DarkSword and temporary memory
One common element across the Apple exploit chains is CVE-2025-43529. Security researchers trace the bug to DarkSword, a commercial-grade exploit kit first documented in March and active across several hacking groups since late 2025.
Public disclosure of flaws often leads to their rapid packaging into automated intrusion frameworks, a pattern previously seen when unpatched system code left administrators vulnerable during the Ubuntu kernel zero-day window. Once public, known bugs become cheap tools for foreign espionage units targeting broad demographics.
Despite the high access level achieved on victim devices, Sekoia discovered that none of the malware components installed persistence tools. The scripts operated entirely inside working system memory.
Because the payload did not modify startup routines, restarting an infected device purged the malicious processes immediately. However, returning to any compromised website on an unpatched browser exposed the handset to reinfection.
Why intelligence agencies target web browsers
Watering hole attacks remain effective because they invert the standard spear-phishing model. Rather than convincing a target to tap an untrusted link in an email, attackers wait for targets to visit industry websites they already trust.
State-backed espionage squads have increasingly focused on consumer mobile platforms because handheld devices contain concentrated personal and professional communications. Chat logs from encrypted messaging apps remain inaccessible over network wiretaps, making local database extraction an intelligence priority.
APT29 has repeatedly altered its infrastructure to intercept high-value targets while travelling or conducting official business. Recent Western security advisories also linked the group to network interception attacks on hotel Wi-Fi networks across Europe.
Both Apple and Google confirmed that patches for all vulnerabilities highlighted in the Sekoia investigation have been released. System administrators and mobile users can neutralise the exploit chains by applying current system and browser updates.
