APT29 Uses Watering Hole Attacks on Trusted Sites
Original title: Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users
AI summary · x-ai/grok-4.7Summaries by Vani AI
APT29 planted malicious scripts on real and cloned websites in the US, Ukraine and Europe to compromise outdated iPhones and Androids by stealing cookies and data.
Russian state-linked APT29 used three entry points including hacked sites, lookalikes and a Ukrainian SEO tracker to deliver exploits targeting iOS and Android devices. The campaign affects out-of-date phones only, with payloads stealing cookies, passwords and more. No persistent access was set up.
Unconfirmed: Exploits may come from third-party sources
Key facts
- Targets outdated iOS 16.7-18.5 and Android Chrome 139-145
- Uses CVE-2025-43529 and multiple other exploits
- Three routes: hacked sites, lookalikes and Plerdy tracker
- Stolen data includes cookies, WhatsApp and photos
- Campaign found mid-October 2026
Security assessment · AI, from the articleExploited in the wild
Impact: Stealing cookies, passwords and device data from compromised phones
What to do
- 1.Update iOS and Chrome
- 2.Replace affected devices
- 3.Review logs for delivery domains
- CVEs
- CVE-2025-43529CVE-2026-20700CVE-2025-14174CVE-2025-43510CVE-2025-43520CVE-2026-3910CVE-2025-27038
- Threat actors
- APT29
- Victims
- iPhone and Android users
- Organizations
- Sekoia
- Countries
- USUkraineCzech RepublicBulgaria
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-14174 | Out of Bounds Memory Access in Google Chromium ANGLE Affects Chrome, Edge, Opera | 8.8 | 55% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
CVE-2025-43510+1 related CVE | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-43529 | Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution | 8.8 | 26% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ads-it-assets.com | stat[.]com Delivery domain used with america250[.]holiday – ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]c |
| domain | adsprism-stat.com | 7[.]232 america250[.]holiday Fake AiTM site 192.121.46[.]25 adsprism-stat[.]com Delivery domain used with america250[.]holiday – ads-it-a |
| domain | adv-static.com | n used with america250[.]holiday – ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com Redirect delivery s |
| domain | america250.holiday | ite, they copied it. They registered two lookalike domains, america250[.]holiday and theowo[.]club. These acted as middlemen for the real |
| domain | assets-int.com | -it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com Redirect delivery servers – File Hashes (SHA-256) Hash Id |
| domain | clouds-stacks.com | ry 109.104.106[.]107, AS395092 (Shock Hosting LLC) edge-ord.clouds-stacks[.]com Delivery 95.133.231[.]28, AS219399 (servinga GmbH) ad.sta |
| domain | flux-telemetry.com | s):- Domains and IP Addresses Indicator Type Details static.flux-telemetry[.]com Delivery 109.104.106[.]107, AS395092 (Shock Hosting LLC) |
| domain | starx-net.com | inds a Samsung Galaxy S25 Ultra. All stolen data goes to ad.starx-net[.]com. None of the payloads set up lasting access, which fits q |
| domain | theowo.club | registered two lookalike domains, america250[.]holiday and theowo[.]club. These acted as middlemen for the real America250 site an |
| domain | wpvortex-mod.com | a250[.]holiday – ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com Redirect delivery servers – File Hashes |
| ipv4 | 109.104.106.107 | Indicator Type Details static.flux-telemetry[.]com Delivery 109.104.106[.]107, AS395092 (Shock Hosting LLC) edge-ord.clouds-stacks[.]co |
| ipv4 | 188.190.17.232 | , AS395092 (Shock Hosting LLC) theowo[.]club Fake AiTM site 188.190.17[.]232 america250[.]holiday Fake AiTM site 192.121.46[.]25 adspr |
| ipv4 | 192.121.46.25 | M site 188.190.17[.]232 america250[.]holiday Fake AiTM site 192.121.46[.]25 adsprism-stat[.]com Delivery domain used with america250[ |
| ipv4 | 195.58.140.105 | 8, AS219399 (servinga GmbH) ad.starx-net[.]com Exfiltration 195.58.140[.]105, AS395092 (Shock Hosting LLC) theowo[.]club Fake AiTM sit |
| ipv4 | 95.133.231.28 | 2 (Shock Hosting LLC) edge-ord.clouds-stacks[.]com Delivery 95.133.231[.]28, AS219399 (servinga GmbH) ad.starx-net[.]com Exfiltration |
| sha256 | 06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f | 67718d3d6e7a6be01d0613d716bce218dba57a928 Class-C-Stage1-JS 06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f Class-C-Stage2-JS 183d62d682aea8018491c8559544e8d6a9ab0e1ab |
| sha256 | 183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8 | 84aa047d5c2d9174d3356c1211cf25f9df677445f Class-C-Stage2-JS 183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8 Class-C-Stage2-CVE-2025-27038 387a7fb768db1350a9788d9704e7a |
| sha256 | 29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928 | 718f6a66f84de69f89425b0a31f2dcee0682f811596f Class-B-Stage3 29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928 Class-C-Stage1-JS 06c17b31d36838f3d29044784aa047d5c2d9174d3 |
| sha256 | 2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa | 681149304e50506509c3498bb6b9a5f5ced6aa73e5fa Class-B-Stage1 2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa Class-B-Stage2 69b6cb327a4d5da99399718f6a66f84de69f89425b0a |
| sha256 | 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c | b0e1abd05ecbb6c97daa4f438d2b8 Class-C-Stage2-CVE-2025-27038 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c AndroSnitch Note: IP addresses and domains are intentionall |
| sha256 | 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f | fb887e73764a913166648135fe0ca7551736d97d7bfa Class-B-Stage2 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f Class-B-Stage3 29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d061 |
| sha256 | a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3 | ct delivery servers – File Hashes (SHA-256) Hash Identifier a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3 Class-A-Stage1 bee3e014e3df87ddce0250b0985b87f6868a427a7b65 |
| sha256 | bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088 | b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3 Class-A-Stage1 bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088 Class-A-Stage2 c170fda024183645c0aa681149304e50506509c3498b |
| sha256 | c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa | 50b0985b87f6868a427a7b650a74b7ffedb9d57f3088 Class-A-Stage2 c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa Class-B-Stage1 2ffb35e3f9e55286a930fb887e73764a913166648135 |
From the original article
4 min read at cybersecuritynews.com
A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria. Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.