Mobile users visiting compromised websites or imitation portals have been exposed to attacks that can steal data without further interaction. In a November 4 report, BleepingComputer described findings by Sekoia showing how attackers selected exploits for visitors’ iOS or Android software, putting browser credentials and, on some devices, private messages and photos at risk.
The attacks used known vulnerabilities for which Apple and Google have released patches. Sekoia attributed the operation with moderate-to-high confidence to the Russian group APT29, also called Midnight Blizzard.
Websites became delivery routes
The campaign reached visitors through high-profile websites in the United States, Ukraine, the Czech Republic and Bulgaria. It combined a watering-hole approach—compromising sites that intended targets might visit—with domains posing as legitimate destinations.
Among the compromised organizations were a Ukrainian gas producer, an American chemical industry trade association and a Bulgarian military-related website. The imitation sites borrowed the identities of America250’s official portal and the Raffles London at The OWO hotel. They passed through content from the genuine sites, placing the attacker between the visitor and the legitimate destination in an adversary-in-the-middle arrangement.
A separate route widened the potential exposure: Sekoia found that attackers had breached Ukrainian web analytics provider Plerdy and changed its SEO tracker, a component used for search optimization tracking. Thousands of websites, predominantly Ukrainian, loaded the tracker between August 27 and September 3.
Each route began with the same JavaScript profiling code. It checked the visitor’s device and browser version, then an attacker-controlled server supplied the corresponding sequence of exploits. These were n-day attacks, meaning they used previously disclosed flaws; opening the page required no further user action for the exploit chain to run.
What each attack could collect
Sekoia’s analysis identified different combinations of vulnerabilities and data targets:
- On iOS 16.7, the chain used CVE-2025-43529 alongside CVE-2024-27834 to target Safari cookies, data websites store in the browser.
- On iOS 18.5, the chain combined CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Its payload gathered WhatsApp and Telegram databases, credentials from Apple’s Keychain storage system, location information and photos.
- For Chrome on Android, versions 139 through 145 except 143, the attackers used CVE-2026-3910 and CVE-2025-27038. The AndroSnitch payload collected Chrome cookies, login information, browsing history and saved WiFi credentials.
The researchers also found references to four additional vulnerabilities in code that could not be reached or in alternative exploit routes; those flaws were absent from the chains they analyzed.
One vulnerability, CVE-2025-43529, has also been associated with the DarkSword exploit kit. That kit was first documented in March and has been used by multiple threat groups in attacks dating back to at least November 2025.
Sekoia based its APT29 assessment on infrastructure shared with earlier activity, similarities to the group’s previous watering-hole operations and a compromised website that a partner had connected to an APT29 campaign in 2025. BleepingComputer also noted that the group had recently been linked to hotel WiFi attacks.
Restarting interrupts activity; updates address the flaws
Sekoia found that none of the campaign’s payloads maintained persistence, or the ability to survive a device restart. Rebooting therefore stops the malicious activity, but another visit to a compromised site can expose the device again.
BleepingComputer reported that Apple and Google have patched every vulnerability used in the campaign, including through updates for older iOS releases. Users should install the latest security updates available for their devices.
