Russian Hackers Use N-Day Exploits in Zero-Click Attacks on iOS and Android Devices

A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users who visit compromised websites or fake portals impersonating legitimate ones, according to researchers at cybersecurity company Sekoia. The campaign used multiple high-profile websites in the United States, Ukraine, the Czech Republic, and Bulgaria that all delivered the same initial payload designed to profile visitors and their devices. This first stage allowed the attacker to determine the browser version of each visitor in order to deploy platform-specific n-day exploit chains without user interaction. Sekoia attributes the operation with moderate-to-high confidence to APT29, also known as Midnight Blizzard, a Russian threat group that was recently linked to hotel WiFi attacks. The researchers cited similarities to past watering-hole operations by the same group, infrastructure overlaps, and a compromised site that a partner connected to a 2025 APT29 campaign. The compromised legitimate sites included those of a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. In addition, lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack model. The researchers also found that the threat actor had compromised the Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3. In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. A command-and-control server then pushed the correct exploit chain for the detected platform. Sekoia says the threat actors exploited multiple vulnerabilities to extract cookies, messaging app databases, and credentials. One of these, CVE-2025-43529, is linked to the DarkSword exploit kit, first documented in March and leveraged in attacks since at least November 2025 by multiple threat groups. The researchers also identified four additional vulnerabilities in unreachable code or alternate exploit paths, but these were not used in the analyzed chains. According to Sekoia, none of the payloads APT29 used in these attacks established persistence, meaning a device reboot would stop the malicious activity until the user visited a compromised site again. Apple and Google have patched all flaws targeted in this campaign, with fixes reaching even older iOS releases. Users are recommended to apply the latest available security updates for their devices.