Security firm Sekoia says it found a large watering-hole campaign in mid-October that used compromised and cloned websites to attack iPhone and Android visitors without any click. It assesses with moderate-to-high confidence that the operator is APT29 (also tracked as Midnight Blizzard), a Russian group widely attributed to the SVR. A watering hole is a site, legitimate or fake, that quietly attacks the people who visit it.
According to Sekoia, the sites carried JavaScript that profiled each visitor’s browser and device, and the delivery server then chose an exploit chain to match. The exploits were n-day flaws, meaning bugs that already had patches. The compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical-industry trade association and a Bulgarian military-related site, as reported by BleepingComputer. Lookalike domains imitated the official America250 site and the Raffles London at The OWO hotel, relaying the real sites’ content. Sekoia also says the operators compromised a Ukrainian web analytics service, Plerdy, for a week from August 27 to September 3, exposing sites that loaded its tracker.
Per BleepingComputer’s summary of the report, the payloads took browser cookies on iOS 16.7, WhatsApp and Telegram databases, Keychain credentials, location data and photos on iOS 18.5, and Chrome cookies, logins, history and saved Wi-Fi credentials on Chrome for Android. One iOS chain is the DarkSword exploit kit; an earlier post covered a DarkSword variant. Sekoia says none of the payloads set up persistence, so a reboot stops the activity until the device visits a compromised site again. Sekoia says its team is coordinating with the CERTs of affected countries.
How to check if you’re affected
Affected devices are iPhones running iOS 16.7 or iOS 18.5 and phones running Chrome for Android 139 to 145 (excluding 143) when they visited a compromised or cloned site, according to BleepingComputer’s summary of the Sekoia report. BleepingComputer says Apple and Google have patched every flaw used in the campaign, with fixes reaching older iOS releases too, so the practical step is to install the latest iOS or iPadOS update and the latest Chrome update. Sekoia’s report lists the CVE ids (including CVE-2025-43529 and CVE-2026-3910), domains and other indicators for defenders. Because the payloads steal cookies and sessions, anyone who believes a device visited one of the named sites should treat logged-in sessions on that device as exposed and sign out and back in; that is a cautious step, not guidance from Sekoia.