A watering hole campaign tied with moderate-to-high confidence to APT29 has been hitting iOS and Android users who visit compromised websites or fake portals that imitate legitimate ones. Researchers at cybersecurity company Sekoia traced the activity to pages and domains that profiled visitors, selected exploit chains by browser version, and delivered payloads without user interaction.
Apple and Google have already patched the flaws used in the campaign. The report says the operation did not establish persistence, so restarting a device stopped the malicious activity until the user returned to a compromised site.
What the campaign targeted
The operation used high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria to deliver the same payload for profiling visitors and their devices. Sekoia said the compromised legitimate sites belonged to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. Lookalike domains also impersonated the official America250 site and Raffles London at The OWO hotel, with content relayed from the real sites in an adversary-in-the-middle model.
The researchers also found that the threat actor compromised the Ukrainian web analytics service Plerdy and altered its SEO tracker. Thousands of websites loaded that tracker, mostly in Ukraine, between August 27 and September 3. In each case, the first payload was JavaScript that identified the visitor’s device and browser version before the command-and-control server sent the matching exploit chain.
Exploits and data collection
According to Sekoia, the attackers used different vulnerability sets depending on the platform and version. On iOS 16.7, they used CVE-2025-43529 and CVE-2024-27834 to target cookies stored in Safari. On iOS 18.5, they used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to collect WhatsApp and Telegram databases, Keychain credentials, location data, and photos. On Chrome for Android 139 to 145, excluding 143, they used CVE-2026-3910 and CVE-2025-27038 and relied on AndroSnitch to gather Chrome cookies, login data, browsing history, and saved WiFi credentials.
The researchers said four other vulnerabilities appeared in unreachable code or alternate exploit paths, but those flaws were not used in the analyzed chains. They also linked CVE-2025-43529 to the DarkSword exploit kit, which was first documented in March and has been used in attacks since at least November 2025 by multiple threat groups. The attribution to APT29 rested on similarities to earlier watering-hole operations by the group, overlaps in infrastructure, and a compromised site that a partner tied to a 2025 APT29 campaign.
Patch status and response
Sekoia said none of the payloads used in these attacks established persistence. That means a reboot stopped the activity until the user returned to a compromised site again. Apple and Google have patched all of the flaws targeted in the campaign, and the fixes reached older iOS releases as well. Users are recommended to install the latest available security updates for their devices.
Licensed under CC BY-ND 4.0 International