Russian hackers target iOS and Android users with n

A sophisticated cyber operation attributed to Russia's APT29, also known as Midnight Blizzard or Cozy Bear, is targeting mobile users on both iOS and Android using n-day exploits for previously patched flaws. The intrusion leverages a multi-vector delivery system that utilizes compromised websites, lookalike domains, and the supply chain compromise of the Ukrainian web analytics service, Plerdy. The attack payloads deploy code injection designed to profile the visitor's device and subsequently serve platform-specific exploit chains without requiring user interaction.
The infrastructure targets high-value sectors globally; initial compromises involved a Ukrainian gas production company, while secondary vectors reached organizations linked to US industry, European politics, and Bulgarian military interests. Specific exploits mentioned involve chaining multiple vulnerabilities in iOS 16.7 and iOS 18.5 devices to steal sensitive data like cookies, messages, and Keychain passwords. On Android, the attack utilized flaws in Chrome and the Adreno graphics driver to exfiltrate credentials and Wi-Fi passwords from certain versions of the browser. The operation underscores a shift toward packaged exploit chains that lower the technical barrier for state-sponsored threat actors.

APT29, also known as Midnight Blizzard or Cozy Bear, is conducting watering hole campaigns targeting iOS and Android users.
The campaign uses compromised websites, lookalike domains, and the Ukrainian web analytics service Plerdy.
Exploits target patched flaws, allowing data theft including cookies, messages, and Wi-Fi passwords.
Sekoia’s Threat Detection & Research team identified the operation in mid-October 2026.
Infection vectors include direct JavaScript injection, Adversary-in-the-Middle-like domains, and supply-chain compromise of Plerdy.
Initial targets included a Ukrainian gas production company, a US chemical industry trade association, and a Bulgarian military organization.
Lookalike domains targeted America250 and Raffles London; the hotel clone was potentially aimed at diplomatic delegations.
On iOS 16.7, attackers chained CVE-2025-43529 and CVE-2024-27834 to steal cookies.
Devices running iOS 18.5 were hit using a DarkSword exploit kit chain involving five CVEs to access SMS, WhatsApp, location data, etc.
Android devices (Chrome versions 139–145 excluding 143) were targeted via Chrome and Adreno graphics driver vulnerabilities to grab Wi-Fi passwords and logins.
Attribution relies on traces of a 2025 APT29 watering hole operation found at a compromised site, similarities to a confirmed 2024 campaign, and victim list focus on Ukraine.

The narrative presents a compelling picture of evolving offensive tradecraft: the weaponization of 'n-day' exploits within a broad, indiscriminate distribution network (watering holes). The core tension lies between the breadth of the attack—targeting potentially thousands of unpatched devices regardless of specific interest—and the high-value targets evidenced by the reconnaissance across diplomatic and military sites. This suggests a dual operational goal: mass data harvesting coupled with targeted intelligence collection.
The critical assumption underpinning this threat assessment is that exploiting *patched* flaws presents an efficiency gain for state actors, suggesting a strategic prioritization of speed and ubiquity over novel vulnerability discovery. Furthermore, the deployment methodology—using a widely utilized analytics service (Plerdy) as a delivery vector—highlights how supply chain reliance can be weaponized against vast, often unwitting, digital ecosystems. This mirrors historical patterns where broad infrastructure compromise serves as a staging ground for highly specific espionage.
The primary implication concerns the diminishing threshold for advanced state-level exploitation. The commoditization of bundled exploit chains like DarkSword drastically lowers the technical hurdle to conduct deep mobile surveillance, shifting the defensive burden onto perpetual patch management rather than robust endpoint integrity. This suggests an acceleration in cyber asymmetry favoring well-funded, persistent actors.
Bridge Questions: If automated scanning and zero-day hunting are becoming economically viable for less sophisticated groups through bundled exploits, what fundamental architectural changes must consumer mobile platforms adopt to neutralize *known* but unpatched vulnerabilities at the network edge? How does the global sourcing of these attack vectors (US trade association, European political party) complicate diplomatic or defensive attribution beyond naming a specific state actor?
Counterstrike Scan: A coordinated influence campaign pushing this narrative would focus on generating widespread fear regarding mobile security to drive compliance with mandated patch cycles or adoption of proprietary security software. The article aligns closely by emphasizing the "n-day" aspect and concluding that "an up-to-date operating system is safe," creating a manageable call to action against manufactured panic while simultaneously documenting highly sophisticated capability levels.
Autonomy check: No autonomy signals.