Russia-linked espionage group APT29 used compromised and lookalike websites to deliver zero-click exploit chains against iOS and Android users in a campaign focused on Ukraine and other European targets, researchers at Sekoia reported. The operation, attributed to the Russian Foreign Intelligence Service-linked actor also known as Midnight Blizzard and Cozy Bear, targeted visitors in Ukraine, the United States, the Czech Republic and Bulgaria. SecurityWeek reported the findings. [1]
The attackers injected JavaScript into legitimate sites belonging to a Ukrainian gas producer, an industry association and a European political organization, while also modifying files on a Bulgarian military-related website. They used reverse-proxy clones of prominent websites, including the America 250 anniversary site and London’s Raffles hotel, to profile visitors and selectively serve platform-specific exploits. Sekoia also found malicious code added to the tracker of Ukrainian analytics provider Plerdy, exposing users of hundreds of sites—including military and defense-related pages—to the campaign.
Two iPhone chains targeted devices running older iOS releases. One combined CVE-2024-27834 with code adapted from the DarkSword exploit kit to bypass Pointer Authentication and steal Safari cookies outside the browser. Apple fixed the flaw in iOS 17.5 and iOS 16.7.8, released in May 2024, and the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog. The second chain targeted iOS 18.5 with CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520; Apple’s advisories say several of those flaws were exploited in highly targeted attacks. [17][19][22]
The consequences extended well beyond browser-session theft. Sekoia said the iOS payloads could collect messages, email, voicemail, contacts, call records, credentials, tokens, photos, browser history and iCloud Drive content. On Android, the attackers chained Chrome’s CVE-2026-3910 with Qualcomm’s CVE-2025-27038 to target Chrome versions 139 through 145, excluding version 143. The Chrome flaw allowed arbitrary code execution inside the browser sandbox via crafted HTML, while the Qualcomm issue involved memory corruption in Adreno graphics drivers. NVD rates CVE-2026-3910 as a high-severity Chrome vulnerability, and Qualcomm issued a security bulletin for CVE-2025-27038 in June 2025. [16][18]
The campaign demonstrates why mobile patching remains critical even when an attack requires no tap, download or malicious application. The vulnerabilities were already disclosed and patched when the watering holes were active, but unupdated devices remained exploitable through ordinary web visits or third-party scripts. Organizations should enforce current Apple, Android, Chrome and device-vendor updates, review web-proxy and DNS telemetry for the reported lookalike domains, and treat stolen browser cookies and credentials as compromised if exposed devices visited the affected sites.
References
- Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
- National Vulnerability Database
- NVD-CVE-2025-43529 – NIST
- CVE-2025-27038 Detail – NVD
- NVD-CVE-2026-20700 – NIST
- NVD-CVE-2025-43520 – NIST
