Russian group APT29 uses watering hole sites to push zero-click exploits to iOS and Android visitors
Because the payloads do not persist, a reboot ends the activity, but the flaws are patched and users should install the latest updates.
A large watering hole campaign, which Sekoia attributes with moderate-to-high confidence to the Russian group APT29 (Midnight Blizzard), has been hitting iOS and Android visitors to compromised or lookalike sites in the US, Ukraine, the Czech Republic and Bulgaria. The first-stage JavaScript fingerprints each visitor's device and browser, then the command-and-control server delivers a matching zero-click exploit chain built from known flaws. Chains targeted Safari cookies on iOS 16.7, WhatsApp and Telegram data, Keychain credentials and photos on iOS 18.5, and Chrome cookies, login data and saved WiFi credentials on Android. Among the compromised sites were a Ukrainian gas producer, a US chemical industry trade association, a Bulgarian military-related site, and the Ukrainian analytics provider Plerdy, whose SEO tracker was modified and loaded by thousands of sites between August 27 and September 3. The payloads did not persist, so a reboot ends the activity, and Apple and Google have patched the targeted flaws, including in older iOS releases, so users should install the latest updates.
Why it matters
The campaign shows that visiting an ordinary, trusted website can be enough to expose a phone to a targeted attack, with no click required. Visitors to compromised sites, including a Ukrainian analytics provider whose tracker thousands of sites loaded, could have had cookies, messaging data, credentials and photos taken from their devices. Because Apple and Google have fixed the targeted flaws, including in older iOS releases, the risk now rests mainly on devices that have not been updated.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.