Russian Hackers Use N-Day Exploits in Zero-Click Attacks on iOS and Android
Original title: Hackers use n-day exploits in zero-click attacks on iOS, Android devices
APT29 deploys n-day exploits via watering-hole sites on iOS and Android devices with no user interaction.
APT29 conducted watering-hole attacks on sites in the US, Ukraine, Czech Republic, and Bulgaria. The campaign used compromised legitimate sites and fake domains to deliver JavaScript profiling payloads that extracted device and browser details. Attackers then pushed platform-specific n-day exploit chains to steal cookies, messaging databases, credentials, and location data. Apple and Google have released patches for all targeted vulnerabilities.
Unconfirmed: Attribution to APT29 has moderate-to-high confidence based on similarities and infrastructure overlaps
- Targets iOS 16.7 and 18.5 plus Chrome for Android 139-145
- Compromised sites include Ukrainian gas producer and US trade association
- No persistence after device reboot
- All flaws patched by Apple and Google
Impact: zero-click data exfiltration of cookies, credentials, and app databases
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome for Android | 139 to 145 excluding 143 | latest releases |
- 1.Update to latest iOS and Android versions
- 2.Review web analytics service logs for modifications
- CVEs
- CVE-2025-43529CVE-2024-27834CVE-2026-20700CVE-2025-14174CVE-2025-43510CVE-2025-43520CVE-2026-3910CVE-2025-27038
- Products
- iOSAndroidChrome for Android
- Threat actors
- APT29
- Organizations
- Sekoia
- Countries
- RussiaUkraineCzech RepublicBulgaria
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | The issue was addressed with improved checks | 5.5 | <1% | ||
| CVE-2025-14174 | Out of Bounds Memory Access in Google Chromium ANGLE Affects Chrome, Edge, Opera | 8.8 | 55% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
CVE-2025-43510+1 related CVE | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-43529 | Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution | 8.8 | 26% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.