Sekoia Links Watering-Hole Campaign Using N-Day Exploits to APT29
Summary
Sekoia reports a watering-hole campaign using zero-click n-day exploit chains against iOS and Android, and attributes it with moderate-to-high confidence to APT29. The attacks profiled devices and targeted data; Apple and Google have patched the flaws.
Key points
- The campaign used compromised and lookalike websites in the U.S., Ukraine, Czech Republic, and Bulgaria to target iOS and Android users.
- Sekoia attributes the operation to APT29 with moderate-to-high confidence, citing similarities to earlier operations, infrastructure overlaps, and a partner's link to a prior campaign.
- Injected JavaScript profiled visitors' devices and browser versions; a command-and-control server then delivered platform-specific exploit chains without user interaction.
- The chains targeted vulnerabilities in iOS and Chrome for Android to collect data including cookies, messaging-app databases, credentials, location data, photos, browsing history, and saved Wi-Fi credentials.
- The attackers also compromised Ukrainian analytics service Plerdy and modified its SEO tracker, which loaded on thousands of sites, mostly in Ukraine, from August 27 to September 3.
- Sekoia says the payloads did not establish persistence, so rebooting a device stopped the activity until the user visited a compromised site again.
- Apple and Google have patched the flaws used in the campaign; the article recommends installing the latest available security updates.
Article Details
- Event Type
- Watering-hole campaign using n-day exploits in zero-click attacks against iOS and Android devices
- Impact
- The campaign used compromised and impersonating websites to profile visitors and deliver device-specific exploit chains. According to Sekoia, the payloads could extract Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, Chrome cookies, login data, browsing history, and saved Wi-Fi credentials. Sekoia reported that the payloads did not establish persistence; Apple and Google have patched the flaws used.
MITRE ATT&CK
T1005 · Data from Local SystemThe payloads collected messaging-app databases, location data, and photos from devices.T1189 · Drive-by CompromiseThe operation used compromised websites and fake sites impersonating legitimate portals to target visitors in a watering-hole attack.T1203 · Exploitation for Client ExecutionThe attackers delivered platform-specific exploit chains that exploited vulnerabilities in visitors’ browsers and devices without user interaction.T1539 · Steal Web Session CookieThe exploit payloads targeted cookies stored in Safari and Chrome.T1555.003 · Credentials from Web BrowsersThe Android payload collected browser login data, and the iOS payload harvested Keychain credentials.T1557 · Adversary-in-the-MiddleLookalike domains relayed content from legitimate sites in an adversary-in-the-middle attack model.
CVE
CVE-2024-27834Apple · iOS and iPadOS; apple · ipad_os; +5 moreCVE-2025-43529 and CVE-2024-27834 (in iOS 16.7).CVE-2025-14174Google · ChromeCVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5).CVE-2025-27038Qualcomm, Inc. · SnapdragonCVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143).CVE-2025-43510Apple · iOS and iPadOS; Apple · macOS; +3 moreCVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5).CVE-2025-43520Apple · iOS and iPadOS; Apple · macOS; +3 moreCVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5).CVE-2025-43529Apple · iOS and iPadOS; Apple · macOS; +4 moreCVE-2025-43529 and CVE-2024-27834 (in iOS 16.7).CVE-2026-20700Apple · Ipados; Apple · Iphone os; +4 moreCVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (in iOS 18.5).CVE-2026-3910Google · ChromeCVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143).
Threat Actors
ICE RELICSekoia attributed the watering-hole operation to APT29 with moderate-to-high confidence, citing similarities to prior operations, infrastructure overlaps, and a compromised site linked by a partner to a 2025 campaign.Midnight BlizzardSekoia attributed the watering-hole operation with moderate-to-high confidence to APT29, also known as Midnight Blizzard, citing similarities to prior operations, infrastructure overlaps, and a compromised site linked by a partner to a 2025 campaign.
Malware
Vendors
AppleApple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases, so users are recommended to apply the latest available security updates for their devices.GoogleApple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases, so users are recommended to apply the latest available security updates for their devices.
Products
AndroidHackers use n-day exploits in zero-click attacks on iOS, Android devicesGoogle ChromeCVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143).iOSHackers use n-day exploits in zero-click attacks on iOS, Android devicesKeychainThe payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.PlerdyThe researchers also discovered that the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27SafariThe payload targets cookies stored in Safari.TelegramThe payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.WhatsAppThe payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
Tools
Countries
BulgariaThe campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices.Czech RepublicThe campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices.UkraineThe campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices.United StatesThe campaign used multiple high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria that delivered the same payload for profiling visitors and their devices.