Hackers use n-day exploits in zero-click attacks on iOS and Android devices

A large-scale attack associated with Russian hackers targeted iOS and Android users visiting compromised or fake sites masquerading as legitimate portals.

The campaign used several leading websites in the United States, Ukraine, Czech Republic and Bulgaria, which provided the same payload for profiling visitors and their devices.

This initial step allows the attacker to determine the browser version to deploy “platform-specific n-day exploit chains without user interaction.”

Researchers at cybersecurity firm Sekoia attribute the operation with moderate to high confidence to APT29 (aka Midnight Blizzard), a Russian threat group recently associated with hotel WiFi attacks.

According to their findings, the legitimate compromised sites belong to a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military site.

Similar domains impersonated the official America250 website and Raffles London at the OWO Hotel, relaying content from the real sites in an adversary-in-the-middle attack model.

Researchers also found that the threat actor compromised the Ukrainian web analytics service Plerdy and modified its SEO tracker, which was loaded by thousands of websites, mainly in Ukraine, between August 27 and September 3.

In all cases, the initial payload was JavaScript code that profiled website visitors to determine their devices and browser versions. The command and control (C2) server then pushed the correct exploit chain.

According to Sekoia, the threat actors exploited the following vulnerabilities to extract cookies, email app databases, and credentials:

• CVE-2025-43529 and CVE-2024-27834 (under iOS 16.7). The payload targets cookies stored in Safari.
• CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 (under iOS 18.5). The payload collects WhatsApp and Telegram databases, keychain credentials, location data, and photos.
• CVE-2026-3910 and CVE-2025-27038 (in Chrome for Android 139 to 145, excluding 143). Uses AndroSnitch to collect Chrome cookies, login data, browsing history and saved WiFi credentials.

The researchers identified four other vulnerabilities in inaccessible code or alternative exploitation paths, but they were not used in the chains analyzed.

CVE-2025-43529 is related to the “DarkSword” exploit kit, first documented in March and exploited in attacks since at least November 2025 by multiple threat groups.

Sekoia claims that none of the APT29 payloads used in these attacks established persistence, allowing restarting the device to stop malicious activity until a compromised site was visited.

Regarding its attribution to APT29, Sekoia notes similarities to past watering hole operations by the same threat group, infrastructure overlaps, and a compromised site that a partner linked to a 2025 APT29 campaign.

Apple and Google have fixed all of the flaws targeted in this campaign, with the fixes even reaching older versions of iOS. Therefore, users are recommended to apply the latest security updates available for their devices.