A large-scale watering hole attack associated with Russian hackers has targeted iOS and Android users visiting compromised sites or fake sites posing as legitimate portals. The campaign used several high-profile websites in the US, Ukraine, the Czech Republic and Bulgaria that offered the same payload to profile visitors and their devices. This initial stage allows the attacker to determine the browser version to deploy “platform-specific n-day exploit chains without user interaction.” Researchers at cybersecurity firm Sekoia attribute the operation with moderate to high confidence to APT29 (also known as Midnight Blizzard), a Russian threat group that was recently linked to WiFi attacks on hotels. According to their findings, the compromised legitimate sites belong to a Ukrainian gas producer, an American chemical industry trade association, and a site linked to the Bulgarian military. Lookalike domains posed as the official America250 and Raffles London site at The OWO hotel, transmitting content from the real sites in an adversarial-in-the-middle attack model. The researchers also discovered that the threat actor had compromised the Ukrainian web analysis service Plerdy and modified its SEO crawler, which was loaded by thousands of websites, mainly in Ukraine, between August 27 and September 3. In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command and control (C2) server then pushed the correct exploit chain. The injected JavaScript code Source: Sekoia According to Sekoia, threat actors exploited the following vulnerabilities to extract cookies, messaging application databases, and credentials: CVE-2025-43529 and CVE-2024-27834 (in iOS 16.7). The payload targets cookies stored in Safari. CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 (on iOS 18.5). The payload collects WhatsApp and Telegram databases, Keychain credentials, location data and photographs. CVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143). It uses AndroSnitch to collect Chrome cookies, login data, browsing history, and saved WiFi credentials. The researchers identified four other vulnerabilities in unreachable code or alternative exploitation paths, but they were not used in the analyzed chains. CVE-2025-43529 is linked to the “DarkSword” exploit kit, first documented in March and exploited in attacks since at least November 2025 by multiple threat groups. Sekoia says that none of the payloads APT29 used in these attacks established persistence, allowing a device reboot to stop malicious activity until a compromised site was visited again. Regarding its attribution to APT29, Sekoia points to similarities with previous watering hole operations carried out by the same threat group, infrastructure overlays, and a compromised site that a partner linked to a 2025 APT29 campaign. Apple and Google have fixed all of the flaws addressed in this campaign, and the fixes even extend to older versions of iOS, so users are advised to apply the latest security updates available for their devices. Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud. See what happens with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX changes. Start your free email security scan.
