MAG212 CYBER ORIGINAL ARTICLE

APT29 Watering Holes Serve n-day Exploits to Outdated iPhones and Android Phones: How to Check Your Fleet

November 4, 2026 · El Mostafa Ouchen

Sekoia has published research on a large watering-hole campaign that profiled the phones of people visiting compromised and lookalike websites. It then served exploit chains that work only on outdated iPhones and Android phones running old Chrome. The payloads stole browser cookies, saved logins, messaging databases and Wi-Fi passwords. Sekoia attributes the campaign to APT29 (also tracked as Midnight Blizzard and Cozy Bear) with moderate-to-high confidence.

Every vulnerability involved was already patched. Devices running a current OS and browser are not affected. The risk sits in the phones your organization assumes are up to date but are not.

Key facts

Item	Detail
Researcher	Sekoia TDR, published November 4, 2026 (campaign detected mid-October)
Attribution	APT29, moderate-to-high confidence (Sekoia assessment)
Targets	iOS 16.x, iOS 18.5, and Chrome for Android 139–145 (not 143)
Delivery	Compromised legitimate sites, lookalike domains, and a compromised analytics tracker
Persistence	None observed: a reboot ends it, a revisit re-infects
Fix	Already available: update iOS and Chrome or Android System WebView

How visitors were reached

Sekoia found injected JavaScript on the real websites of organizations including a Ukrainian gas producer, a US chemical-industry trade association, a Bulgarian military-related site and several political sites. Lookalike domains relayed genuine content from an America250 portal and a London hotel, in an adversary-in-the-middle style. A third route ran through Plerdy, a Ukrainian web-analytics service whose SEO tracker was compromised between August 27 and September 3, 2026, and loaded by thousands of mostly Ukrainian sites.

Delivery chain as reported by Sekoia. MAG212 CYBER original diagram.

How the exploit chains work

A fingerprinting script collects 394 data points from 61 collectors and sends them to the attackers’ server. The server-side gate mostly rejects devices that do not look like phones, such as an odd screen size or no touch points. It then returns a matching exploit chain:

Chain	Target	CVEs (all patched)	Data taken
A	iOS 16.7 (works on 16.0–17.4)	CVE-2025-43529, CVE-2024-27834	Safari cookies
B	iOS 18.5 (“DarkSword” kit)	CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520	Messaging databases, Keychain data, location, photos
C	Chrome for Android 139–145, not 143 (“AndroSnitch”)	CVE-2026-3910, CVE-2025-27038	Chrome cookies, saved logins, history, Wi-Fi configuration

All three chains send data to one exfiltration endpoint. None of the payloads established persistence, so rebooting ends the session, though it does not undo data already taken.

Why cookie theft matters to the business

A stolen session cookie can let an attacker into webmail or a SaaS app without a password or MFA prompt, until that session is revoked. Resetting the password alone may not end it. For anyone whose phone could have been exposed, revoke sessions first, then rotate credentials.

How to check your fleet

MDM inventory: list managed devices that ran iOS 16.x–17.4, iOS 18.5 or Chrome for Android 139–145 between August and today.
DNS and web-gateway logs: look for ad.starx-net[.]com (port 8881), america250[.]holiday and theowo[.]club. Traffic to a.plerdy[.]com during August 27–September 3 is a lead only: Plerdy is a legitimate service that was compromised.
Identity logs: unfamiliar sessions on webmail and SaaS for the owners of those devices, and new linked devices on WhatsApp or Telegram.

Keep three findings separate in your notes: a device visited a listed site, it was fingerprinted, and it was exploited. Each supports a different level of response. Sekoia has not published all of its indicators; national CERTs can request the full set.

For a managed Android test device with USB debugging authorized by the owner, these read-only commands show the patch level and Chrome version. They cannot diagnose exploitation:

adb shell getprop ro.build.version.security_patch
adb shell dumpsys package com.android.chrome | grep versionName

On iPhone, check Settings › General › About for the iOS version.

Contain, fix and verify

Update iOS and iPadOS, and Chrome or Android System WebView, to current releases. Use MDM compliance rules to block devices below your minimum builds.
For exposed users, revoke active sessions in your identity provider and key SaaS apps, then rotate passwords. Remove unknown linked messaging devices.
Verify: MDM reports compliant builds, and sign-in logs show no reuse of revoked sessions.

For staff who travel or work with government, energy or diplomacy: keep automatic updates on, restart your phone weekly, consider Lockdown Mode on iPhone if you are a likely target, and report unexpected sign-in alerts right away.

Frequently asked questions

Is my up-to-date iPhone at risk from this campaign?

According to Sekoia, no. All three chains rely on vulnerabilities that Apple and Google have already patched, so a current OS and browser are not affected.

Does rebooting remove the infection?

Sekoia observed no persistence, so a reboot ends the payload until the device visits a malicious page again. It does not undo stolen cookies or data, so revoke sessions too.

How sure is the APT29 attribution?

It is Sekoia’s assessment, at moderate-to-high confidence, based on overlaps with earlier APT29 watering holes, shared infrastructure, and a compromised site a partner linked to a 2025 APT29 operation.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free