A Russian-linked hacking group known as APT29 (Midnight Blizzard) has been linked to a large-scale watering hole campaign targeting iOS and Android users via compromised websites and fake portals.
According to cybersecurity company Sekoia, the campaign affected websites in the United States, Ukraine, the Czech Republic, and Bulgaria. Compromised sites included a Ukrainian gas producer, a US chemical industry trade association, and a Bulgarian military-related website. Attackers also created fake websites impersonating the America250 portal and Raffles London at The OWO hotel.
The attackers injected malicious JavaScript code into websites to identify visitors' devices, operating systems, and browser versions. The collected information was sent to command-and-control (C&C) servers, which delivered specific exploit chains based on the victim's device. The attacks required no user interaction.
As part of the campaign, the attackers exploited several vulnerabilities targeting mobile devices, including CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, and CVE-2024-27834. The exploits targeted Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location information, and photos. CVE-2025-43529 had previously been linked to the DarkSword iOS exploit kit, which has been used in attacks since at least November 2025.
Threat actors also abused a couple of flaws affecting Android, more specifically CVE-2026-3910 and CVE-2025-27038. The attackers used a tool called AndroSnitch to collect Chrome cookies, saved passwords, browsing history, and Wi-Fi credentials.
The campaign also compromised Ukrainian web analytics service Plerdy, with attackers altering its SEO tracking script, potentially exposing visitors across thousands of websites, mainly in Ukraine, between August 27 and September 3.
Researchers attributed the campaign to APT29 with moderate-to-high confidence, based on similarities to previous operations, overlapping infrastructure, and connections to earlier campaigns.
Sekoia also noted that the malicious payloads did not establish persistence on infected devices. This means restarting a device stops the malicious activity, although infection can occur again if the user visits a compromised website.