Sekoia has documented a large watering-hole campaign that targets iOS and Android visitors with zero-click n-day exploit chains. It assesses with moderate-to-high confidence that APT29, also tracked as Midnight Blizzard, is behind it. BleepingComputer and The Hacker News reported the findings on November 4 and 5.
The first stage is JavaScript that profiles the visitor's device and browser. The command-and-control server then serves a platform-specific exploit chain that needs no user interaction. Per Sekoia, the operators compromised legitimate sites and also ran lookalike domains that impersonated the America250 site and Raffles London at The OWO hotel, relaying real content in an adversary-in-the-middle setup.
A supply chain element widened the reach. The attacker modified the SEO tracker of Plerdy, a Ukrainian web analytics service. Thousands of sites, mostly in Ukraine, loaded it between August 27 and September 3. Compromised sites included a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Payload delivery was seen in the U.S., Ukraine, the Czech Republic and Bulgaria.
Sekoia lists the exploited flaws by platform. On iOS 16.7 the chain uses CVE-2025-43529 and CVE-2024-27834 and targets Safari cookies. On iOS 18.5 it uses CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, and harvests WhatsApp and Telegram databases, Keychain credentials, location data and photos. On Chrome for Android 139 to 145 (excluding 143) it uses CVE-2026-3910 and CVE-2025-27038, and an implant called AndroSnitch collects cookies, login data, browsing history and saved WiFi credentials. CVE-2025-43529 is linked to the DarkSword exploit kit, which multiple groups have used since at least November 2025.
CVE-2024-27834 is a medium-severity (CVSS 5.5) Pointer Authentication bypass in WebKit that Apple fixed in May 2024. CISA added it to the Known Exploited Vulnerabilities catalog on November 4 and set a November 18 deadline for federal civilian agencies.
Why it matters: every flaw in these chains is already patched. The campaign relies on devices that lag behind on updates. Sekoia found no persistence in the payloads, so a reboot stops the activity until the user visits a compromised site again. That limits dwell time but not theft. Cookies, session data and messaging databases are taken in a single visit.
Mitigation: update iOS, iPadOS, Safari and Chrome for Android to current releases. Apple's fixes extend to older iOS branches. Audit third-party scripts such as analytics and SEO trackers on your own sites, and treat session cookies from unpatched mobile devices as potentially exposed. Hunt for traffic to the lookalike domains named in Sekoia's report, "Poisoned Source: APT29 watering holes targets mobile devices with n-day exploits."
