APT29 hackers target iOS and Android devices in watering hole attacks

Cybersecurity researchers at Sekoia have uncovered a large-scale watering hole campaign targeting iOS and Android users. The threat actors leveraged compromised high-profile websites and lookalike domains across the U.S., Ukraine, the Czech Republic, and Bulgaria to deliver platform-specific exploits.

• A large-scale watering hole campaign targets iOS and Android users via compromised and fake websites.
• Initial JavaScript profiling allows attackers to deploy zero-click exploit chains seamlessly.
• Researchers attribute the activity with moderate-to-high confidence to the APT29 threat group.
• Apple and Google have already issued security patches for all targeted vulnerabilities.

Attack Infrastructure and Vector Analysis

The compromised legitimate sites include a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related portal. Additionally, lookalike domains impersonated official sites such as America250 and Raffles London using adversary-in-the-middle tactics. Researchers also discovered that the Ukrainian web analytics service Plerdy was compromised, modifying its SEO tracker loaded by thousands of sites between August 27 and September 3.

In all identified cases, the initial payload was a JavaScript code designed to profile visitor devices and browser versions. The command-and-control server then delivered the appropriate exploit chains. Vulnerabilities such as CVE-2025-43529 and other flaws in iOS 18.5 were leveraged to harvest sensitive data, including WhatsApp and Telegram databases, Keychain credentials, location data, and photos.

Threat Attribution and Persistence

Sekoia attributes the operation to APT29 (Midnight Blizzard) based on infrastructure overlaps, similarities to past campaigns, and specific compromised assets. Notably, none of the payloads deployed by APT29 established device persistence, meaning that a simple device reboot halts the malicious activity until the user visits a compromised site again.

Security Recommendations for Device Owners

Apple and Google have patched all the security flaws exploited in this malicious campaign, with Apple even backporting fixes to older iOS versions. Users are strongly advised to apply the latest available software and security updates to their mobile devices to ensure full protection against these threat vectors.