Sekoia Reports Midnight Blizzard Campaign Using Watering Holes to Target iOS and Android
Summary
Sekoia reports that suspected Midnight Blizzard operators used compromised or cloned sites and a Plerdy supply-chain compromise to deliver three iOS and Android exploit chains targeting patched vulnerabilities and harvesting device data.
Key points
- Sekoia attributes the campaign to suspected Russian state-sponsored actor Midnight Blizzard and reports targets in Europe and the US.
- Compromised or cloned sites in the US, Ukraine, the Czech Republic, and Bulgaria delivered code that fingerprinted visitors before exploits were sent.
- A Plerdy tracker compromise reportedly exposed hundreds of sites to the exploit kit for one week.
- Sekoia identified three chains using previously patched vulnerabilities: two targeting iOS and one targeting Android.
- The iOS chains used DarkSword; one also exploited CVE-2024-27834 to bypass PAC protections and steal cookies outside Safari.
- The Android chain used CVE-2026-3910 and CVE-2025-27038; its AndroSnitch payload targeted Chrome data, including passwords and Wi-Fi passwords.
Article Details
- Attack Vectors
- Watering-hole attacks used compromised or cloned websites to inject malicious JavaScript that fingerprinted visitors before delivering exploit chains.
- Lookalike domains acted as adversary-in-the-middle reverse proxies for copies of high-profile websites and injected malicious code.
- A supply-chain attack added malicious code to Plerdy’s tracker file, exposing websites using the tracker to the exploit kit.
- Exploit chains targeting iOS and Android used previously patched vulnerabilities to execute code and, in one iOS chain, escalate privileges.
- Defensive Notes
- CVE-2024-27834 was patched in iOS 17.5, iPadOS 17.5, iOS 16.7.8, iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, and watchOS 10.5; CISA directed federal agencies to patch it within two weeks.
- CVE-2026-3910 was patched as a zero-day in March, according to the article.
- CVE-2025-27038 was patched in Android’s August 2025 security update, according to the article.
MITRE ATT&CK
T1005 · Data from Local SystemThe payloads were designed to collect data stored on devices, including messages, contacts, photos, browser history, and iCloud Drive content.T1059.007 · JavaScriptMalicious JavaScript was injected into websites and used to fingerprint visitors before exploit delivery.T1068 · Exploitation for Privilege EscalationOne iOS chain used DarkSword for privilege escalation.T1189 · Drive-by CompromiseMidnight Blizzard’s campaign used compromised or cloned websites as watering holes to expose visitors to exploit chains.T1195.002 · Compromise Software Supply ChainThe attackers added malicious code to Plerdy’s tracker file, exposing websites that used the tracker.T1203 · Exploitation for Client ExecutionThe iOS and Android exploit chains used browser and operating-system vulnerabilities to execute code on visitors’ devices.T1539 · Steal Web Session CookieAn iOS chain stole cookies outside Safari, and the Android payload targeted cookies stored in Chrome.T1555.003 · Credentials from Web BrowsersAndroSnitch targeted passwords stored in Chrome on Android devices.T1557 · Adversary-in-the-MiddleLookalike domains acted as reverse proxies for high-profile sites in an adversary-in-the-middle setup, injecting malicious code into the proxied copies.T1592 · Gather Victim Host InformationInjected JavaScript fingerprinted visitors by collecting browser and device configuration data before exploit delivery.
CVE
CVE-2024-27834Apple · iOS and iPadOS; apple · ipad_os; +5 moreremote code execution (RCE) code from DarkSword for arbitrary read/write access, and then exploits CVE-2024-27834 to bypass Apple’s Pointer Authentication Codes (PAC) protection and execute code that steals cookiesCVE-2025-27038Qualcomm, Inc. · Snapdragontargets Android users via CVE-2026-3910, a Chrome vulnerability patched in March as a zero-day, and CVE-2025-27038, a Qualcomm bug patched with Android’s August 2025 security update.CVE-2026-3910Google · ChromeMidnight Blizzard’s last exploit chain targets Android users via CVE-2026-3910, a Chrome vulnerability patched in March as a zero-day, and CVE-2025-27038, a Qualcomm bug patched with Android’s August 2025 security
Threat Actors
Cozy BearThe article identifies Cozy Bear as another name for Midnight Blizzard, which Sekoia reports was behind the campaign.ICE RELICThe article identifies APT29 as another name for Midnight Blizzard, which Sekoia reports was behind the campaign.Midnight BlizzardSekoia reports that Midnight Blizzard carried out the watering-hole campaign and associated iOS and Android exploit chains; the article describes the attribution as believed.
Malware
ANDROSNATCHIt is similar to AndroSnatch, a Chrome cookie stealer Google TAG observed in Midnight Blizzard attacks mounted between 2023 and 2024.AndroSnitchThe final payload, AndroSnitch, targets data stored in Chrome, including cookies, account information, passwords, browser history, and Wi-Fi passwords.
Vendors
Apple(RCE) code from DarkSword for arbitrary read/write access, and then exploits CVE-2024-27834 to bypass Apple’s Pointer Authentication Codes (PAC) protection and execute code that steals cookies outside of Safari.GoogleIt is similar to AndroSnatch, a Chrome cookie stealer Google TAG observed in Midnight Blizzard attacks mounted between 2023 and 2024.Qualcommusers via CVE-2026-3910, a Chrome vulnerability patched in March as a zero-day, and CVE-2025-27038, a Qualcomm bug patched with Android’s August 2025 security update.
Products
AndroidRussian state-sponsored threat actor Midnight Blizzard is believed to have targeted iOS and Android users in Europe and the US with zero-click exploits targeting n-day vulnerabilities, cybersecurity firm Sekoia reports.Google ChromeMidnight Blizzard’s last exploit chain targets Android users via CVE-2026-3910, a Chrome vulnerability patched in March as a zero-day, and CVE-2025-27038, a Qualcomm bug patched with Android’s August 2025 securityiCloud DriveThe final payload was designed to fully harvest the device: messages, emails, voicemails, credentials, tokens, contacts, calls, calendar entries, browser cookies and history, photos, and iCloud Drive content.iOSRussian state-sponsored threat actor Midnight Blizzard is believed to have targeted iOS and Android users in Europe and the US with zero-click exploits targeting n-day vulnerabilities, cybersecurity firm Sekoia reports.iPadOSCVE-2024-27834 was patched in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5.macOS SonomaCVE-2024-27834 was patched in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5.SafariApple’s Pointer Authentication Codes (PAC) protection and execute code that steals cookies outside of Safari.tvOSCVE-2024-27834 was patched in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5.watchOSCVE-2024-27834 was patched in May 2024 in iOS 17.5 and iPadOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5, watchOS 10.5.
Tools
Countries
BulgariaThe attacks uncovered by Sekoia, mounted as part of a large-scale watering hole campaign, involved compromised or cloned high-profile websites of organizations in the US, Ukraine, the Czech Republic, and Bulgaria.Czech RepublicThe attacks uncovered by Sekoia, mounted as part of a large-scale watering hole campaign, involved compromised or cloned high-profile websites of organizations in the US, Ukraine, the Czech Republic, and Bulgaria.UkraineThe attacks uncovered by Sekoia, mounted as part of a large-scale watering hole campaign, involved compromised or cloned high-profile websites of organizations in the US, Ukraine, the Czech Republic, and Bulgaria.United Kingdomanniversary of American independence, and the website of the Raffles London at The OWO hotel near sensitive UK government institutions.United StatesThe attacks uncovered by Sekoia, mounted as part of a large-scale watering hole campaign, involved compromised or cloned high-profile websites of organizations in the US, Ukraine, the Czech Republic, and Bulgaria.