Suspected Russian hackers used old iPhone and Android bugs on fake sites

They set a trap on websites their targets were likely to visit. This is called a watering hole attack, after predators that wait where prey comes to drink.

The attack started when an iPhone or Android user opened one of potentially hundreds of sites. Hidden JavaScript, the code that makes web pages interactive, then checked the visitor's browser and device. Based on what it found, the attackers sent the exploit that matched that phone.

Every flaw in this campaign was an n-day. That means a bug the maker already fixed. It only works on devices that have not installed the fix.

This is the key detail. A zero-day, a bug nobody has patched yet, is nearly impossible to defend against. An n-day is the opposite: updating the phone closes it.

In real life Think of a lock the maker has already replaced for free. The burglar can only get in if you never swapped yours.

The attacks were also zero-click. That means they worked without the target tapping or downloading anything beyond loading the page.

Sekoia says the attackers used three ways to reach victims: injecting code into traffic from real websites, using fake copies of real websites, and compromising a service that many sites load.

• America250: the attackers registered a lookalike domain and used it as a go-between for the real America250 site, a group tied to the 250th anniversary of the signing of the US Constitution. Sekoia says the event may have been picked as a theme for invitation-style phishing, which means fake messages that trick people into clicking.
• The OWO hotel: a fake copy of the site for Raffles London at The OWO, a luxury hotel close to the Ministry of Defence and 10 Downing Street. Sekoia says this may have aimed at diplomats and high-profile guests.
• Compromised real sites: a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related site.
• Plerdy: a Ukrainian web analytics service. The attackers changed its tracking script, which thousands of mostly Ukrainian sites loaded between August 27 and September 3.

The code sent one of three exploit chains, depending on the device. An exploit chain is a series of bugs used one after another to break through.

• iOS 16.7: two flaws, CVE-2025-43529 and CVE-2024-27834. The payload went after cookies stored in Safari.
• iOS 18.5: five flaws. The payload harvested WhatsApp and Telegram databases, Keychain passwords, location data and photos.
• Chrome for Android 139 to 145 (not 143): two flaws. A tool called AndroSnitch collected Chrome cookies, saved logins, browsing history and saved Wi-Fi passwords.

Sekoia also found four other flaws in code that was not reached or in backup paths, but they were not used in the analyzed attacks.

One flaw, CVE-2025-43529, is linked to an exploit kit called DarkSword. Google researchers have said customers of PARS Defense, a commercial surveillance vendor in Turkey, and at least two other threat groups used it. A cookie is a small file that keeps you logged in, so stolen cookies can let an attacker use your accounts.

Sekoia says it has moderate to high confidence that the group is APT29, also called Midnight Blizzard, and that it is part of Russia's Foreign Intelligence Service. The firm points to the profile of the targets, infrastructure overlaps with older attacks and a compromised site that a partner linked to a 2025 APT29 campaign.

The catch: this is an assessment. Attribution in cybersecurity is a judgment call, so it is worth reading the wording carefully.

No. In 2024, Google's Threat Analysis Group said APT29 hit Mongolian government websites between November 2023 and July 2024. The exploits were nearly identical to ones used earlier by the commercial spyware makers Intellexa and NSO Group.

In August 2025, Amazon said it disrupted another APT29 watering hole. Its chief information security officer, CJ Moses, said the target was Microsoft's device code sign-in flow. Amazon said about 10% of visitors to the booby-trapped sites were redirected, which helped the group stay hidden.

The pattern is steady: Russian hackers go after credentials and intelligence, and they are happy to use bugs that are already public.

The lookalike sites act as a go-between, which security people call an adversary-in-the-middle setup. A visitor opens the fake address, and the fake site quietly fetches the real site's pages and passes them along.

Everything looks right, because it is the real content. The one difference is the extra malicious JavaScript slipped into each page. That is why a familiar-looking page is not proof of a safe one.

Google's Threat Analysis Group described attacks on Mongolian government sites. In November 2023, APT29 added a hidden frame to the foreign ministry and cabinet websites. A frame is a window inside a web page, and this one loaded an exploit for an iPhone flaw, CVE-2023-41993, that stole browser cookies from phones on iOS 16.6.1 and older.

In February 2024 the group hit another Mongolian government site with the same exploit. In July 2024 it used two Chrome flaws, CVE-2024-5274 and CVE-2024-4671, against Android users on that site.

That was the odd part. Google noted the exploits were almost identical to ones that NSO Group and Intellexa, two commercial spyware makers, had used first, when no fix existed. How APT29 got them is unknown. Possible explanations include hacking those firms, getting help from insiders, or buying the bugs from a broker who had sold them before. Writing them from scratch with little information seems unlikely.

APT29 also has history here. In 2021 it used another iPhone flaw, CVE-2021-1879, as a zero-day against government officials in Eastern Europe, to steal LinkedIn, Gmail and Facebook logins.

That is unclear. Sekoia did not say how many phones were infected. It did say none of the payloads set up persistence, meaning they did not survive a restart. Rebooting stopped the activity until the phone visited a booby-trapped site again.

Apple and Google have fixed every flaw involved, and the fixes even reached some older iPhone releases.

• Update now: install the latest iOS and Chrome updates. Every bug in this campaign was already patched.
• Turn on automatic updates: then you never have to remember.
• Restart now and then: it will not replace an update, but it cuts short some attacks.
• Be careful with lookalike links: an invitation to a site that looks right but has an odd web address is a warning sign.