Hackers use n-day exploits in zero-click attacks targeting iOS and Android | Межа

Sekoia attributes the campaign to APT29 with moderate-to-high confidence. Its exploit chains required no interaction after the initial website visit.

A large-scale watering-hole campaign linked to Russian hackers has been targeting iOS and Android users who visited compromised websites or fake sites impersonating legitimate portals. It used high-profile websites in the United States, Ukraine, the Czech Republic and Bulgaria to deliver the same payload and profile visitors and their devices.

This is reported by BleepingComputer .

Sekoia said compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying content from the real sites in an adversary-in-the-middle attack.

The researchers also found that the attackers compromised Ukrainian web analytics service Plerdy and modified its SEO tracker. Thousands of websites, mostly in Ukraine, loaded the tracker between August 27 and September 3.

The initial payload in each case was JavaScript that identified visitors’ devices and browser versions. A command-and-control server then sent an exploit chain tailored to the device and browser, without requiring further user interaction.

Sekoia said the attackers exploited vulnerabilities to extract cookies, messaging app databases and credentials. Researchers identified four other vulnerabilities in unreachable code or alternate exploit paths, but said those were not used in the analyzed chains.

CVE-2025-43529 is associated with the DarkSword exploit kit, first documented in March. Multiple threat groups have used it in attacks since at least November 2025.

Sekoia said none of the payloads used by APT29 established persistence. Rebooting a device stops the malicious activity until the user visits a compromised site again.

Sekoia cited similarities to earlier watering-hole operations by the same group, overlapping infrastructure and a compromised site that a partner linked to an APT29 campaign in 2025 as reasons for attributing the operation to APT29.

Apple and Google have patched all the flaws targeted in the campaign, including in older iOS releases. Users are advised to install the latest available security updates for their devices.

Truecaller rolls out a family admin feature that alerts members to potential scam calls and allows an admin to remotely end calls on Android, expanding globally with India highlighted as a key growth market and reinforcing the company’s anti fraud strategy.

A Pentagon personnel system breach exposed unencrypted personal records of 2.8 million living people and nearly 300,000 deceased, including Social Security numbers and military service details.