Skip to content
HACKTECH
Mobile & IoTReported Published 2 sources

Sekoia ties mobile watering-hole campaign using iOS and Android n-day chains to APT29

Sekoia's Threat Detection & Research team reported on 4 November 2026 a watering-hole campaign, uncovered in mid-October, that used compromised or cloned websites in the US, Ukraine, the Czech Republic and Bulgaria to profile visitors and serve platform-specific n-day exploit chains to unpatched iPhones and Android devices without user interaction. Between 27 August and 3 September 2026 the attackers also tampered with the Plerdy analytics tracker, which Sekoia says is loaded by thousands of mostly Ukrainian websites. Sekoia assesses with moderate to high confidence that APT29 (Midnight Blizzard) ran the campaign, and says every flaw used had been fixed by the respective vendor before it began.

  • mobile spyware
  • iOS
  • Android
  • watering-hole attacks
  • APT29
  • DarkSword
  • third-party scripts

What the sources report

  • Chain A used CVE-2025-43529 and CVE-2024-27834 against iOS 16.7 to steal cookies; BleepingComputer describes the target as Safari cookies, while Sekoia says the method could also reach cookies stored by other apps.
  • Chain B, which Sekoia matched to the DarkSword iOS exploit kit, chained CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 on iOS 18.5 and harvested data including messages, WhatsApp and Telegram databases, Keychain credentials, location data and photos.
  • Chain C used CVE-2026-3910 and CVE-2025-27038 against Chrome for Android versions 139 to 145 (excluding 143), with a payload Sekoia calls AndroSnitch that collected Chrome data and saved Wi-Fi passwords.
  • Lookalike domains impersonating the America250 website and Raffles London at The OWO acted as reverse proxies that injected the malicious script into the genuine sites' content.
  • According to BleepingComputer, Sekoia says none of the payloads established persistence, so a reboot stops the activity until the device visits a compromised site again; Sekoia says it is coordinating with the CERTs of affected countries on victim identification.

What it means for your organisation

No zero-days were needed: every chain relied on vulnerabilities the vendors had already fixed, so exposure came down to devices running outdated iOS or Chrome versions. The campaign also shows how one compromised third-party script, here a web analytics tracker, can turn many unrelated websites into delivery points. Enforcing mobile patch levels and controlling third-party JavaScript are levers most organisations already have.

What we check

  • Confirm from MDM that minimum iOS and Chrome for Android versions are enforced across the mobile fleet, starting with staff who travel or hold privileged access.
  • Inventory third-party JavaScript on your websites, apply Subresource Integrity and a restrictive Content Security Policy, and alert on unexpected script changes.
  • Monitor for lookalike domains that reverse-proxy your public sites, and include takedown steps in the incident response plan.
  • When targeting is suspected, collect mobile forensic artefacts before devices are rebooted, since these payloads did not persist.

Sources

Services that cover these checks

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Website security audit

    A review of a public website's TLS and security headers, third-party scripts, CMS and plugin versions, forms, authentication and hosting configuration. Every check is marked pass, fail or not applicable with the evidence attached, so the result doubles as a compliance artefact.

    Duration: 3 to 6 working days

  • Mobile application testing

    iOS and Android testing of the binary, on-device storage and transport, and of the backend API the app calls, replaying the app's own tokens to check whether one user can read another's data. On the device we check what the keychain or keystore stores, whether certificate pinning survives a bypass attempt and what deep links can trigger.

    Duration: 6 to 10 working days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works