Hackers used n-day exploits in zero-click iOS and Android attacks

A large watering-hole campaign linked with moderate-to-high confidence to the Russian threat group APT29 targeted iOS and Android users who visited compromised websites or lookalike portals, according to cybersecurity researchers at Sekoia.

The campaign involved prominent websites in the U.S., Ukraine, the Czech Republic and Bulgaria. Compromised sites included one belonging to a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the America250 website and Raffles London at The OWO hotel.

In each case, JavaScript first profiled visitors’ devices and browser versions. A command-and-control server then sent platform-specific n-day exploit chains that did not require user interaction. The researchers also found four other vulnerabilities in unreachable code or alternate exploit paths, but said those were not used in the analyzed chains.

The campaign also involved a compromise of Ukrainian web analytics service Plerdy. Its modified SEO tracker was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3. Sekoia said the payloads did not establish persistence, so rebooting a device stopped the malicious activity until it visited a compromised site again.

Sekoia cited similarities to earlier APT29 watering-hole operations, overlapping infrastructure and a site linked by a partner to a 2025 APT29 campaign as evidence for the attribution. Apple and Google have patched all flaws targeted in the campaign, including in older iOS releases. The source recommends applying the latest available security updates.