Russian Cyber Threat: Large-Scale Watering Hole Attack Targets iOS and Android Users
A significant cybersecurity threat has emerged, attributed to Russian hackers who are executing a wide-ranging watering hole attack aimed at unsuspecting users of iOS and Android devices. This sophisticated campaign identifies users through various compromised and fraudulent websites posing as legitimate platforms.
Attack Overview
The attackers have reportedly utilized a range of high-profile websites across the United States, Ukraine, the Czech Republic, and Bulgaria to deliver malicious payloads that profile visitor devices. This profiling stage enables the attackers to ascertain browser versions, allowing them to deploy specific “n-day exploit chains” without needing any user interaction.
Attribution to APT29
Researchers from cybersecurity firm Sekoia have assigned the attack to APT29, known as Midnight Blizzard, a Russian threat group linked to previous hotel WiFi exploitations. Investigations revealed that the compromised sites included those belonging to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related organization.
Moreover, fraudulent domains mimicked legitimate sites such as America250 and Raffles London at The OWO hotel, delivering content in a manner consistent with adversary-in-the-middle attack strategies.
Technical Execution
In their analysis, researchers discovered that the threat actors had compromised Plerdy, a Ukrainian web analytics service, altering its SEO tracker that was utilized by numerous websites predominantly in Ukraine over the course of a week.
The initial malicious payload consisted of JavaScript code designed to profile users by determining both device type and browser version. Following this, a command-and-control (C2) server initiated the delivery of targeted exploit chains.
Source: Sekoia
Exploited Vulnerabilities
The researchers have identified several vulnerabilities that the attackers exploited to extract sensitive data such as cookies, messaging app databases, and user credentials:
- CVE-2025-43529 and CVE-2024-27834 (iOS 16.7): Targeting stored cookies in Safari.
- CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 (iOS 18.5): Harvesting WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
- CVE-2026-3910 and CVE-2025-27038 (Chrome for Android 139 to 145, excluding 143): Utilizing AndroSnitch to collect Chrome cookies, login details, browsing histories, and saved WiFi credentials.
Additionally, Sekoia discovered four more vulnerabilities within unreachable code or alternative exploit paths; however, these were not used in the analyzed attack chains. Notably, CVE-2025-43529 is part of the “DarkSword” exploit kit, which has been utilized in attacks since at least November 2025 by multiple hacker groups.
Countermeasures and Recommendations
It is important to note that all exploits employed in this campaign did not achieve persistence; hence, a simple device reboot could halt the malicious activities until the user revisits a compromised site. In response to this threat, both Apple and Google have patched the vulnerabilities targeted by these attackers, with updates extending to older iOS versions. Users are strongly encouraged to install the latest security updates for their devices.
As cybersecurity threats evolve, staying informed and vigilant remains critical for safeguarding personal and sensitive information.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
