A sophisticated watering hole campaign attributed to Russian state-sponsored actors has been targeting mobile visitors on iOS and Android devices with zero-click exploit chains. Security researchers at Sekoia discovered the activity in mid-October 2026 and assessed with moderate to high confidence that the operation was orchestrated by APT29, also known as Midnight Blizzard and Cozy Bear.

According to reporting from BleepingComputer and Help Net Security, the threat actor delivered exploit payloads without requiring user interaction beyond visiting a compromised website. The campaign relied on known, patched vulnerabilities—commonly referred to as n-day flaws—to exfiltrate session cookies, messaging databases, and saved credentials from vulnerable phones.

Compromised Sites and Supply-Chain Vectors

The campaign relied on three distinct delivery mechanisms to direct mobile users into the exploitation pipeline. Attackers injected malicious JavaScript into legitimate websites, deployed adversary-in-the-middle clone domains, and compromised a third-party analytics provider.

Compromised legitimate properties included a Ukrainian gas production company, a U.S. chemical industry trade association, a Bulgarian military-related organization, an Australian medical clinic, and a European political party. In parallel, the attackers established lookalike domains spoofing the U.S. America250 initiative and Raffles London at The OWO, a luxury hotel near the U.K. Ministry of Defence where Ukrainian President Volodymyr Zelensky reportedly stayed during an October visit.

For broader scale, the threat actor breached Ukrainian web analytics provider Plerdy. Between August 27 and September 3, 2026, the attackers modified Plerdy's SEO tracking script, serving malicious profiling code across thousands of client websites, including platforms operated by Ukrainian armed forces, special operations units, and defense equipment manufacturers.

How the Exploits Profile and Target Mobile Devices

Regardless of the infection route, every compromised source loaded an initial JavaScript payload designed to fingerprint the visitor's mobile operating system and browser version. Once device details were verified, the delivery server pushed a matching exploit chain tailored specifically to that platform.

The attackers deployed three primary exploit configurations across different mobile operating systems:

  • iOS 16.7: Chained CVE-2025-43529 and CVE-2024-27834 to access and exfiltrate browser cookies stored inside Safari, enabling session hijacking against webmail and other cloud services.
  • iOS 18.5: Chained CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 using components of the commercial DarkSword exploit kit. This payload harvested Keychain credentials, SMS, iMessage, WhatsApp and Telegram databases, location data, health records, and stored photos.
  • Android (Chrome versions 139 to 145, excluding 143): Combined Google Chrome vulnerability CVE-2026-3910 with Qualcomm Adreno graphics driver flaw CVE-2025-27038. The chain deployed AndroSnitch to steal Chrome browsing history, stored credentials, session cookies, and saved Wi-Fi network passwords.

Researchers noted that none of the malicious payloads established local persistence on compromised devices. Consequently, restarting an infected device clears the payload from memory, terminating unauthorized data collection until a user visits an infected page again.

Threat Actor Attribution

Sekoia linked the campaign to APT29 based on several technical indicators, including overlaps in command-and-control infrastructure and operational similarities to previous watering hole campaigns. These included a confirmed 2024 campaign against Mongolian government portals documented by Google's Threat Analysis Group, as well as digital traces of a 2025 APT29 operation identified on one of the compromised servers.

The operation also demonstrates the growing adoption of commercial surveillance frameworks by state-aligned groups. By reusing packaged exploit kits such as DarkSword, threat actors substantially reduce the financial and technical overhead required to launch sophisticated mobile attacks.

What Defenders and Mobile Users Should Do

Because all targeted vulnerabilities were patched by Apple and Google prior to the discovery of this campaign, fully updated mobile operating systems are not susceptible to these exploit chains. Security teams and individual users should implement the following measures:

  • Update operating systems immediately: Ensure all corporate and personal iOS and Android devices are updated to the latest available operating system and browser releases. Apple has issued security patches for both current and older supported iOS branches.
  • Update mobile browsers: Verify that mobile browsers, particularly Google Chrome on Android, are running the latest release from official app stores.
  • Enforce Mobile Device Management (MDM) hygiene: Enterprise administrators should mandate compliance policies that block out-of-date mobile operating systems from accessing corporate services and Microsoft 365 environments.
  • Reboot suspected devices: If a device is suspected of accessing compromised links, perform an immediate device reboot to flush volatile memory, followed by password resets and session revocations for sensitive accounts.
  • Audit third-party scripts: Web administrators should review external scripts and supply-chain dependencies, enforcing Subresource Integrity (SRI) where feasible to detect unauthorized modifications to analytics or tracking libraries.