APT29-linked watering hole campaign used n-day exploits on iOS and Android
Sekoia attributes a large-scale watering hole operation to APT29 with moderate-to-high confidence. The payloads chained already-patched browser and OS flaws, and none of them established persistence.
A watering hole campaign that Sekoia attributes to APT29 with moderate-to-high confidence has been hitting iOS and Android visitors to compromised and lookalike sites, BleepingComputer reported on November 4.
The lures were real enough. Compromised legitimate sites belonged to a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle setup. Sekoia also found the actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which loaded on thousands of websites, mostly in Ukraine, between August 27 and September 3.
In each case the first stage was JavaScript that profiled the visitor's device and browser version. The command-and-control server then pushed the matching exploit chain, which the researchers describe as running without user interaction.
The chains leaned on flaws that were already fixed. One set targeted iOS 16.7 to pull cookies from Safari. Another ran against iOS 18.5 and harvested WhatsApp and Telegram databases, Keychain credentials, location data and photos. On Chrome for Android 139 to 145, excluding 143, the payload used AndroSnitch to collect Chrome cookies, login data, browsing history and saved WiFi credentials.
Sekoia says none of the payloads established persistence, so a reboot stops the activity until the device visits a compromised site again. Apple and Google have patched all the flaws targeted, with fixes reaching older iOS releases.
The attribution rests on similarities to earlier APT29 watering holes, infrastructure overlaps and a compromised site a partner tied to a 2025 APT29 campaign. That's a reasonable case, not a closed one. The report doesn't say how many visitors were hit.
For defenders, the practical point is dull: the exploit chains needed unpatched devices, and the fixes exist. Check browser and OS versions on managed phones first, and treat a Plerdy-loaded tracker on Ukrainian sites in that window as worth reviewing.
CVE references
Sources
- Hackers use n-day exploits in zero-click attacks on iOS, Android devicesPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
