Russian-Linked Hackers Use Zero-Click Exploits to Target iPhones and Android Devices

A widespread cyberespionage campaign linked to Russian state-backed hackers has targeted iPhone and Android users through compromised websites and fraudulent online portals. The attacks exploit previously disclosed security vulnerabilities to steal sensitive information from mobile devices without requiring users to click malicious links or download files.

Hackers Target Mobile Users Through Compromised Websites

Cybersecurity researchers at Sekoia have identified a large-scale watering-hole campaign involving legitimate websites and convincing copies of trusted online services.

The operation targeted visitors to websites in the United States, Ukraine, the Czech Republic, and Bulgaria. Attackers used malicious JavaScript to identify visitors’ devices, operating systems, and browser versions before delivering specially selected exploits.

This technique allowed hackers to launch platform-specific attacks without additional user interaction, potentially exposing personal information and confidential communications.

Sekoia attributed the campaign with moderate-to-high confidence to APT29, also known as Midnight Blizzard, a Russian-linked cyberespionage group previously associated with sophisticated attacks against government agencies and businesses.

U.S. Organizations and International Websites Among Targets

According to the researchers, attackers compromised websites belonging to a Ukrainian natural gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related organization.

The campaign also involved fraudulent domains impersonating the official America250 website, associated with the United States’ 250th anniversary celebrations, and Raffles London at The OWO, a luxury hotel in the United Kingdom.

These imitation websites relayed content from legitimate services using an adversary-in-the-middle approach, making the malicious pages appear authentic to unsuspecting visitors.

Researchers also discovered that the attackers had compromised Plerdy, a Ukrainian web analytics provider.

Between August 27 and September 3, malicious modifications to Plerdy’s search engine optimization tracking script potentially exposed visitors across thousands of websites, primarily in Ukraine.

Zero-Click Exploits Target iOS and Android Security Flaws

The attacks relied on previously disclosed vulnerabilities, commonly called n-day flaws, for which security information or patches were already available.

Unlike traditional phishing attacks, which often require victims to open attachments or follow suspicious links, these exploit chains could activate when users visited affected websites.

The malicious JavaScript first collected information about the visitor’s browser and device. An attacker-controlled command-and-control server then selected and delivered the appropriate exploit chain.

iPhone Attacks Target Messages, Passwords and Photos

Sekoia identified multiple exploit combinations targeting different versions of Apple’s iOS operating system.

For devices running iOS 16.7, attackers used CVE-2025-43529 and CVE-2024-27834 to access cookies stored in Apple’s Safari browser.

A more extensive exploit chain targeting iOS 18.5 involved five vulnerabilities:

• CVE-2025-43529

• CVE-2026-20700

• CVE-2025-14174

• CVE-2025-43510

• CVE-2025-43520

This combination enabled attackers to extract WhatsApp and Telegram databases, credentials stored in Apple’s Keychain, location information, and photographs.

The findings demonstrate how multiple security weaknesses can be combined to access sensitive information stored on smartphones.

Android Exploits Steal Browser Data and Wi-Fi Credentials

Android users were also targeted through vulnerabilities affecting Google Chrome and Qualcomm components.

The researchers identified CVE-2026-3910 and CVE-2025-27038 in attacks against Chrome for Android versions 139 through 145, excluding version 143.

Attackers deployed an information-stealing tool known as AndroSnitch to collect Chrome cookies, saved login information, browsing history, and stored Wi-Fi credentials.

Sekoia also identified four additional vulnerabilities in alternative exploit paths or unreachable code, although those flaws were not used in the exploit chains examined.

Researchers Connect Campaign to DarkSword Exploit Kit

One vulnerability, CVE-2025-43529, has been associated with the DarkSword exploit kit, a collection of tools designed to compromise vulnerable iPhones.

DarkSword was first publicly documented in March 2026, although researchers found evidence of its use by multiple threat groups dating back to at least November 2025.

Sekoia linked the latest operation to APT29 based on similarities with earlier watering-hole campaigns, overlapping attack infrastructure, and a compromised website associated by a research partner with a 2025 APT29 operation.

The attribution remains an assessment based on technical evidence rather than definitive identification of the individuals responsible.

Apple and Google Security Updates Protect Against Known Exploits

Sekoia reported that the malicious payloads analyzed did not establish persistence on infected devices.

As a result, restarting an affected smartphone could interrupt malicious activity. However, users could face renewed exposure if they subsequently visited a compromised website while running vulnerable software.

Apple and Google have released patches addressing all vulnerabilities exploited in the campaign. Apple has also extended certain security protections to older iOS versions.

Security experts recommend installing the latest available operating system and browser updates to reduce exposure to known exploit chains.

The campaign highlights the continuing risks posed by sophisticated cyberespionage operations that exploit trusted websites to reach mobile users. Although the identified vulnerabilities have been patched, keeping smartphones updated remains essential to protecting personal data, online accounts, and private communications.