Hackers use n-day exploits in zero-click attacks on iOS, Android devices
A large-scale watering hole campaign, attributed to Russian state-sponsored hackers APT29, has been targeting iOS and Android users with zero-click n-day exploits.
Intelligence analysis by Gemini 2.5 Flash
The sophisticated campaign compromised high-profile websites and a Ukrainian web analytics service to deliver platform-specific exploits. These attacks allowed the threat actors to steal sensitive data like cookies, messaging app databases, and credentials from unsuspecting users without any interaction.
Imagine a sneaky digital spy who can peek into your phone's secrets just by you visiting a website, even if you don't click anything! These hackers, like a secret club called APT29, found hidden weaknesses in phones and used them to steal things like your messages, photos, and passwords. It's like they found a secret back door that opened automatically when you walked by, but thankfully, phone companies have now locked those doors with updates.
Analysis
APT29
Researchers at cybersecurity company Sekoia have attributed a recent large-scale watering hole attack with moderate-to-high confidence to APT29, also known as Midnight Blizzard. This Russian threat group has a history of sophisticated cyber operations, including a recent link to hotel WiFi attacks, indicating a consistent pattern of targeting specific individuals or organizations through various vectors.
The campaign involved compromising multiple high-profile websites across the U.S., Ukraine, the Czech Republic, and Bulgaria. These sites, which included a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site, were used to deliver an initial payload designed to profile visitors and their devices. This initial reconnaissance allowed the attackers to tailor subsequent zero-click n-day exploit chains to specific browser versions and operating systems without requiring any user interaction.
CVE-2025-43529
The threat actors exploited several vulnerabilities, including CVE-2025-43529, which is linked to the "DarkSword" exploit kit. This particular exploit has been documented since March and actively leveraged in attacks since at least November 2025 by various threat groups, underscoring its potency and widespread use in the cyber espionage landscape.
For iOS devices, the campaign targeted vulnerabilities like CVE-2025-43529 and CVE-2024-27834 in iOS 16.7 to extract Safari cookies. More critically, for iOS 18.5, a chain of exploits including CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 allowed the harvesting of WhatsApp and Telegram databases, Keychain credentials, location data, and photos. Android users running Chrome versions 139 to 145 (excluding 143) were also affected by CVE-2026-3910 and CVE-2025-27038, which utilized the AndroSnitch tool to collect Chrome cookies, login data, browsing history, and saved WiFi credentials.
Plerdy
A significant vector for the initial payload delivery was the compromise of the Ukrainian web analytics service Plerdy. Between August 27 and September 3, the threat actor modified Plerdy's SEO tracker, which was then loaded by thousands of websites, predominantly in Ukraine. This allowed the attackers to cast a wide net, profiling a large number of potential targets.
Once a user visited a compromised site or a lookalike domain impersonating legitimate portals like America250 or Raffles London at The OWO hotel, the injected JavaScript code profiled their device. This profiling determined the specific browser and operating system, enabling the command-and-control server to push the most effective platform-specific n-day exploit chain. While the attacks were sophisticated, Sekoia noted that none of the payloads established persistence, meaning a device reboot would stop the malicious activity until the user revisited a compromised site. Apple and Google have since patched all identified flaws, emphasizing the importance of timely software updates.
Key points
- Russian state-sponsored group APT29 (Midnight Blizzard) is linked to a large-scale watering hole attack.
- The campaign used zero-click n-day exploits targeting iOS and Android devices.
- Compromised legitimate websites and a Ukrainian web analytics service (Plerdy) were used for initial payload delivery.
- Exploits targeted vulnerabilities in iOS 16.7, iOS 18.5, and Chrome for Android, stealing cookies, messaging data, and credentials.
- Apple and Google have released patches for all exploited flaws, including older iOS versions.
Apple and Google have already released patches for all the vulnerabilities exploited in this campaign, including fixes for older iOS releases. This swift action significantly reduces the attack surface and protects users who apply the latest security updates, demonstrating the effectiveness of rapid vendor response.
Despite patches, the use of n-day exploits, which are vulnerabilities already known but not yet widely patched, highlights a persistent window of opportunity for sophisticated attackers. Users who delay updates or use devices no longer supported by security patches remain vulnerable to these advanced zero-click attacks, posing an ongoing risk of data compromise.
