A large-scale watering-hole campaign attributed with moderate-to-high confidence to Russian threat group APT29 has targeted iOS and Android users through compromised websites and domains impersonating legitimate portals. Researchers at cybersecurity company Sekoia say the operation used sites in the United States, Ukraine, the Czech Republic and Bulgaria to deliver code that profiled visitors and selected exploits for their devices without requiring interaction.
The compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site, according to the researchers. The attackers also used lookalike domains posing as the official America250 site and Raffles London at The OWO hotel, relaying content from the genuine sites through an adversary-in-the-middle setup.
Sekoia also found that the attackers had compromised Ukrainian web analytics provider Plerdy and altered its SEO tracker. The modified tracker was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3. In the cases analyzed, JavaScript first identified visitors’ devices and browser versions, after which a command-and-control server supplied the corresponding exploit chain.
The exploits targeted vulnerabilities in older versions of iOS and Chrome for Android. On iOS 16.7, the chain targeted Safari cookies. A separate chain for iOS 18.5 sought WhatsApp and Telegram databases, Keychain credentials, location data and photos. On Chrome for Android versions 139 to 145, except version 143, the AndroSnitch payload collected cookies, login data, browsing history and saved Wi-Fi credentials.
Sekoia identified four additional vulnerabilities in unreachable code or alternative exploit paths, but said they were not used in the chains examined. The researchers also linked CVE-2025-43529 to the DarkSword exploit kit, which was first documented in March and has been used by multiple threat groups since at least November 2025.
The payloads did not establish persistence, Sekoia said, meaning a device reboot would stop the activity until the user visited a compromised site again. The researchers based their APT29 attribution on similarities to the group’s previous watering-hole operations, infrastructure overlaps and a compromised site that a partner had linked to an APT29 campaign in 2025.
Apple and Google have patched all the vulnerabilities targeted in the campaign, with fixes also reaching older iOS releases. Users are advised to install the latest security updates available for their devices.
Sources: BleepingComputer.