Hackers use n-day exploits in zero-click attacks on iOS, Android devices

What it is

A watering-hole campaign that Sekoia attributes, with moderate-to-high confidence, to APT29 (Midnight Blizzard). Compromised sites include a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the America250 site and Raffles London at The OWO hotel, relaying real content in an adversary-in-the-middle setup. The actor also modified the SEO tracker of the Ukrainian analytics service Plerdy, which thousands of mostly Ukrainian sites loaded between 27 August and 3 September.

How it works

Every site serves the same JavaScript profiler. It identifies the device and browser version, and the command-and-control server then pushes a matching exploit chain with no user interaction.

flowchart TD
    A[Visitor loads site] --> B[JS profiler]
    B --> C{Device and version}
    C -->|iOS 16.7| D[Safari cookies]
    C -->|iOS 18.5| E[Apps, Keychain, location, photos]
    C -->|Chrome Android 139-145| F[AndroSnitch]
    C -->|No match| G[No chain delivered]

The last branch is an inference from the page, which only says the server picks the correct chain.

Preconditions / Affected

The chains are keyed to specific versions:

• iOS 16.7: CVE-2025-43529 and CVE-2024-27834. The payload targets Safari cookies.
• iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. The payload harvests WhatsApp and Telegram databases, Keychain credentials, location data and photos.
• Chrome for Android 139 to 145, excluding 143: CVE-2026-3910 and CVE-2025-27038. The AndroSnitch payload collects Chrome cookies, login data, browsing history and saved WiFi credentials.

CVE-2025-43529 is tied to the "DarkSword" exploit kit, first documented in March 2026 and used by multiple groups since at least November 2025. Sekoia found four more vulnerabilities in unreachable code or alternate exploit paths, which were not used in the analyzed chains.

What to do

Apple and Google have patched every flaw used, including fixes for older iOS releases. The page's only recommendation is to install the latest security updates. Devices still on iOS 16.7 or 18.5, or on Chrome for Android in the 139 to 145 range, are the exposed population. For defenders, any traffic to the Plerdy tracker during the 27 August to 3 September window is worth reviewing, since the page names that script as a delivery path.

Caveats

Attribution rests on similarity to past APT29 watering-hole operations, infrastructure overlaps, and a compromised site that a partner linked to a 2025 APT29 campaign. It is not stated as certain. None of the payloads set persistence, so a reboot stops the malicious activity until the device visits a compromised site again. Data already taken (cookies, Keychain entries, messaging databases, Chrome credentials) is not undone by a reboot or patch. The page gives no indicators of compromise, domain lists or detection queries.