APT29-linked campaign exploits outdated Apple and Android software

A cyberespionage operation linked to Russia’s APT29 hacking group has targeted vulnerable iPhones and Android devices through compromised websites, using previously patched security flaws to extract confidential information without requiring victims to click malicious links.

Cybersecurity company Sekoia disclosed the campaign on Wednesday, assessing with moderate to high confidence that APT29, also known as Midnight Blizzard or Cozy Bear, or an associated subgroup was responsible. The operation, identified in mid-October and named Poisoned Source, combined malicious website scripts, deceptive domains and a compromised analytics service.

Researchers found that the attackers deployed three separate exploit chains tailored to visitors’ operating systems and browser versions. The resulting malware could capture authentication cookies, saved passwords and browsing information, while one iPhone attack was capable of extracting personal communications and files.

Sekoia emphasised that the vulnerabilities had already been addressed by software vendors. The attacks therefore depended on devices running outdated software rather than previously unknown security weaknesses. Its findings did not establish how many visitors were successfully compromised or identify confirmed individual victims.

One significant distribution route involved Plerdy, a Ukrainian website analytics service whose tracking script is embedded across websites. Attackers modified the script between 27 August and 3 September, exposing visitors to hundreds of websites carrying the affected tracker. The compromise widened the operation beyond individually selected websites.

Other entry points included legitimate websites associated with a Ukrainian gas producer, military organisations and equipment suppliers, a US chemical industry trade association and military-related interests in Bulgaria. Researchers also identified deceptive domains impersonating the America250 initiative and a London hotel.

The hotel impersonation raised the possibility that diplomatic delegations or high-profile visitors were among the intended targets, although Sekoia did not establish that such individuals had been infected. The campaign’s selection of websites and similarities to earlier operations contributed to the researchers’ attribution assessment.

When someone opened an affected page, injected JavaScript collected technical characteristics of the browser and device. Attack infrastructure then selected an appropriate exploit chain, allowing the attack to proceed without further interaction if the device was susceptible. This technique is commonly described as a watering-hole attack because malicious code is placed where prospective targets are likely to visit.

The first iPhone chain targeted iOS 16.7, exploiting vulnerabilities identified as CVE-2025-43529 and CVE-2024-27834 to obtain browser cookies. Stolen cookies can potentially allow attackers to reuse authenticated sessions, including access to online accounts, depending on the protections deployed by services.

A second chain targeted iOS 18.5 using DarkSword, a mobile exploitation framework previously associated with commercial surveillance activity. Sekoia identified five vulnerabilities in this sequence, which could reach beyond browser information to extract messages, contacts, call records, photographs, location information and stored credentials.

The collection capabilities also extended to data associated with WhatsApp, Telegram, Apple Mail, iCloud Keychain and other applications. Researchers described the potential exposure as broader than the cookie theft attempted against older iOS installations.

For Android, the attackers targeted Chrome versions 139 through 145, excluding version 143, using two patched vulnerabilities. The resulting payload, called AndroSnitch, sought browser cookies, saved login information, browsing history and Wi-Fi credentials. Sekoia did not determine why the attackers excluded the Chrome release.

None of the analysed payloads established lasting persistence on infected devices. That limitation means malicious activity would not automatically survive a reboot, although information already transmitted to attacker-controlled infrastructure could remain compromised. Returning to an affected website with vulnerable software could expose a device again.

The use of DarkSword also highlighted the circulation of exploitation tools beyond their original operators. Sekoia assessed that the attackers may have obtained the mobile exploits from a third party rather than developing every component. That assessment rests on technical similarities and does not identify a supplier or establish a commercial transaction. The firm said the campaign differed from an earlier operation against Mongolian government websites because the newer scripts did not restrict cookie collection to a predetermined set of domains.

The researchers also observed a check that stopped the Android exploitation sequence on a Samsung Galaxy S25 Ultra model. They did not establish the reason for that exclusion.

Sekoia said it was working with computer emergency response teams in affected countries to identify potential victims and examine options for disrupting the infrastructure. It acknowledged assistance from Ukraine’s CERT-UA and Google’s Threat Analysis Group in investigating the operation and identifying vulnerabilities.