Russian hackers use zero-click exploits to hit iOS and Android through hijacked sites

Security researchers at Sekoia say a Russian state-backed hacking group used a large-scale watering hole campaign to hit iOS and Android users with zero-click exploit chains, requiring no interaction from victims beyond visiting a compromised or lookalike website. The firm attributes the operation with moderate-to-high confidence to APT29, also tracked as Midnight Blizzard, the same group Microsoft has linked to the SolarWinds breach and a string of recent hotel Wi-Fi attacks.

Watering hole attacks work by compromising sites a target audience is likely to visit, rather than attacking targets directly. That approach matters here because it lets a well-resourced state actor cast a wide net and let victims come to the exploit, instead of sending a phishing link that a target might recognize and avoid. Sekoia says the campaign combined three separate tactics: compromising real websites, standing up lookalike domains, and quietly hijacking a widely used web analytics script.

How the exploit chain worked

Injected JavaScript on the booby-trapped pages first fingerprinted each visitor's device type and browser version. A command-and-control server then served a platform-specific exploit chain tuned to that profile. On iOS 16.7, the attackers chained CVE-2025-43529 and CVE-2024-27834 to grab Safari cookies. On iOS 18.5, a longer chain, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, harvested WhatsApp and Telegram databases, Keychain credentials, location data, and photos. On Chrome for Android versions 139 through 145 (excluding 143), CVE-2026-3910 and CVE-2025-27038 were paired with a tool Sekoia calls AndroSnitch to steal cookies, saved logins, browsing history, and Wi-Fi credentials.

All of these are “n-day” flaws — vulnerabilities that already had patches available, but which still work against any device that hasn't installed the latest security update. CVE-2025-43529 in particular is tied to the “DarkSword” exploit kit, first documented in March 2026 and reportedly in use by multiple threat actors since at least November 2025.

Compromised sites and a supply-chain twist

The campaign hit a mix of real and fake targets. Sekoia found legitimate sites compromised directly, including a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-adjacent site. Separately, attackers stood up lookalike domains impersonating the official America250 anniversary site and the Raffles London hotel at The OWO, relaying the real sites' content in an adversary-in-the-middle setup so visitors saw no difference.

The most consequential move was a supply-chain compromise of Plerdy, a Ukrainian web analytics provider. Attackers modified its SEO-tracking script between late August and early September, and the altered code loaded on thousands of websites that embed the Plerdy tracker, the large majority of them in Ukraine.

What happens next

None of the payloads established persistence on infected devices, meaning a simple reboot stopped the activity until the user revisited a compromised site. Apple and Google have since patched every exploited vulnerability, including backports for older iOS releases. Sekoia's findings, first reported by Bill Toulas at BleepingComputer, underscore a pattern security researchers have flagged before: state-linked groups increasingly recycle exploits originally built by commercial spyware vendors, turning patched “n-day” bugs into effective weapons against anyone who falls behind on updates.

For most users, the practical takeaway is straightforward: install iOS and Android security updates as soon as they're available, since every flaw used in this campaign has a fix. Organizations that embed third-party analytics or tracking scripts should also treat them as part of their attack surface, not just a marketing tool — the Plerdy compromise shows how a single trusted vendor can become a distribution channel for malware across thousands of unrelated sites.